IRule-XFforwar4 , for non HTTP resquests

Hello guys

 

I´m trying to detect a original ip address that conect on our server but in a non HTTP or HTTPS request, in this case a 9000 port.

 

Normally id use XFF profile to detect this original source ip, but didn´t work.

 

In my thoughts this type of traffic to track probally i will need to use a IRULE.

 

How can i compose this irule ?

 

Hughes from Brazil