Ask Information : pool member down log message

Would guess the IP address in the SYN-ACK response is not the same in the original SYN request so marking failing the monitor.

Recommend you do a tcpdump to capture the network traffic and see if any errors in the TCP packets.

K411: Overview of packet tracing with the tcpdump utility

which version of Big-IP is it?

1. version is TMOS 12.1.2 HF1.
2. platform is BIG-IP i4800 LTM
3. Use Tcp-half-open monitor.
4. One-arm DSR... And Server have loopback address(loopback address is set virtual address with do not arp response).
5. One monitor check the Real Server IP:Port, The other monitor check Real Server's loopback address:Port(use alias)

If you are using DSR then the IP address of the server in the response will be different, it should be the F5 Virtual Server address, hence why you are getting the error.

Recommend you change the monitor from 'tcp_half_open' to something else, I would first try with 'ICMP' to confirm it is working. Following that try the full 'tcp' monitor or an application specific monitor.