i want to run tcpdump on bigip active device in HA, between internal sever and bigip internal interface.

you should use the floating, in normal SNAT-Automap condition (traffic sent first with floating IP as source, if too many connections, SelfIP is used additionally).

Self IP will be the source IP for health monitoring traffic

the health monitor is always using self IP addresses. This of all cluster devices (not dependent of active or standby state)