Monitoring returning traffic

Hi all, in one of my recent incidents someone had accidentally remove a firewall rule and it had cause the returning traffic to be routed out to the Internet.   On the F5 I was able to see the in...