F5 TCP Issue

From the BIG-IP command line, issue the following to show the TCPDUMP manual:

man tcpdump

There you'll find all of the syntax you need and some pretty good examples.

tcpdump -lnni internal:nnn host 1.1.1.1 and host 2.2.2.2

This basically says, take a network capture, without trying to resolve host names and protocol names (-lnn), on the "internal" interface/VLAN (i internal), make the output verbose (:nnn), and filter the traffic so I only see packets coming from or going to host IP 1.1.1.1 and 2.2.2.2.

Do this on the external interface (client source address to BIG-IP VIP), and on the internal interface (client source if not SNATting or SNAT address to server IP). Do these at the same time in separate windows so that you can see the full packet flow.