Packet capture is a powerful tool that can help narrow down issues with phones picking up an IP address on the wrong VLAN.
In the example below, we have a Cisco Meraki switch connected to a router that has two VLANs, Data on VLAN 20 and Voice on VLAN 40.
Each of the phones is connected to an access port configured for data vlan 20 and voice 40 as shown below
However, the phones are picking up an IP address on the data VLAN "20" which could indicate that either the phone isn't snooping for LLDP/CDP, or the switch port isn't configured properly.
The capture below was taken from a port where a phone that supports LLDP is connected to, using the Wireshark display filter "LLDP" we can clearly see the Cisco Meraki switch sending multicast LLDP specifying the correct voice VLAN-ID.
The LLDP-MED Network Policy with VLAN-ID in it is sent (visible as TIA - Network Policy in Wireshark within the LLDP-packet)
The same is true about CDP. The Cisco Meraki switch will send a CDP packet with the Data and Voice VLAN info
The screenshot below shows a packet capture taken from a switch that has a phone connect on port 6, and is configure for data Vlan 100 and Voice Vlan 200.
The screenshot shows the switch sending Vlan 200 tag for voice in the CDP packet