Ltm::Virtual Server: IPForwarding

"A Forwarding (IP) virtual server forwards packets directly to the destination IP address specified in the client request. A Forwarding (IP) virtual server has no pool members to load balance." So basically this turns your F5 into a router and unless you have a traffic filter configured, it sends the packets you have in the destination VIP based on the routes you have on the F5.

I see a lot of clients configure a wildcard forwarding VIP with destination 0.0.0.0:0 which allows any protocols through, IP, TCP, UDP, etc. Some clients configure a forwarding VIP in combination with a route friendly fastl4 profile to allow asymmetric routing. Other use it simply to all ICMP, traceroute, and other protocols that they don't want to just block at the F5.

https://support.f5.com/kb/en-us/solutions/public/14000/100/sol14163.html

https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html

You can figure out what traffic is going through the F5 during these spikes by running a tcpdump and using the wireshark summary page to get a statistics for what kinds of traffic are occurring. You can set the snaplen to a lower value to not capture as much of the payload so your capture will not be huge...

tcpdump -vvv -nni any:nnnp -s 100 -w everything.pcapng

Also what is the destination IP and port of your forwarding VIP? Is it 0.0.0.0:0?