How to check the source IP of an "open connection" ?

Hello,

Recently, the F5 I manage was suspected to be under attack.

There were as many as 650 K "open connections" and I wanted to check the source IP of these connections.

I tried  "tmsh show sys connection"  and found that it only shows up to 1000 connections.

What else can I do?



Any help is appreciate.