Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Thunderbird/38.6.0
It is my understanding that if you had the resources to run a tcpdump or
something like that, you wouldn't use lwIP but a full fledged stack.
lwIP has a logging system you can use, but the most useful alternative
is to connect it to a hub or a switch with monitor function and capture
the traffic with wireshark on a PC connected to that very same hub/switch.