Found this in the TCP DUMP section of the Maintenance Commands Help files:
Captured data is saved into files and placed in the /Vmail folder. All SIP signaling files in the /Vmail folder have names in the format of WS_xxxxxx.pcap. A maximum of 20 compressed files of approximately 5-Mbyte size can be created by MiVoice Business. To collect the most recently captured data, download the SOS report from Administration > View log files in Server Manager. If logging is left running for a long time, you can manually download all the WS_xxxxx.pcap files using sftp or scp.
NOTES
Once retrieved, it is strongly recommended to use the SIP TCPDUMP CLEAR command.
The SOS report generated from Administration > View log files in Server Manager contains the latest SIP TCPDUMP file.