TCPDump for capturing traffing between Virtual Server and Pool Members

Hi, Considering that F5 is a full proxy then you have two distinct client to server connections:

1. first is (SRC:172.16.16.100 and DST:172.16.16.1),
2. second is (SRC:X.X.X.X and DST:10.10.10.11 or 10.10.10.12), src depends on your SNAT configuration, if using automap then it is an F5 self IP.

So your tcpdump needs to have an "OR" to match both connections, you've set up and "AND". Something like:

tcpdump -ni 0.0 (src host 172.16.16.100 and dst host 172.16.16.1) or (dst host 10.10.10.11 or dst host 10.10.10.12)