configure f5 login using AD

If you can install WireShark anywhere, you can do a tcpdump from the BIG-IP and export it to WireShark:

tcpdump -lnni 0.0 port 389 -s0 -w ad_capture.pcap

This will listen on all interfaces for port 389 (LDAP) traffic, set snaplen to 0 so that tcpdump doesn't concatenate anything, and write this capture to a file. You can then scp this file to another machine and open it with WireShark.