Cirrus
MVPYou can use tcpdump -nni 0.0:nnnp host <client ip address> to match both sides of the connection as documented in https://support.f5.com/csp/article/K13637
You can use the flowid to match the frontend and backend connections: https://support.f5.com/csp/article/K59414829
CirrusThank you for your response. Because we are capturing traffic on any interface with tcpdump -i 0.0 option, should not it capture all the traffic including poolmembers and self Ip. Why would we still need p option? I see that p option may cause some high resource utlization. Is there any significance to use p option? Can't we just use the client ip without the p option and add the VIP and pool members option like below and then filter it out with the flow from clientside associated to serverside
tcpdump -ni 0.0:nnn host<VIP ip address> or host<pool1 ip address> or host <pool 2 ip address>