If you need to perform a packet capture you can use the following below to get this exported to a PCAP file you can then open in WireShark.
debug packet capture ports 1 on file-name voip001 count 100
debug packet capture off
ls /usr/local/tmp
You can then TFTP off the file with the following:
tftp put <TFTPServer> vr "VR-Default" /usr/local/tmp/voip001.pcap
I normally use TFTP32/64 on the machine to which i’m TFTPing, but this has had problems recently.
https://bitbucket.org/phjounin/tftpd64/issues/22/cantt-connect-to-the-serviceerror-10061
Remember to delete the PCAP file once you’re done so its not using up disk space on your switch!