tcpdump to monitor health monitors (GTM)

The GTM itself might not actually be running the monitor. If you have other BIG-IPs (LTMs, GTMs) created as server objects in the GTM config any one of them might be running the monitor at any given time by default. The preferred method, if possible, is that the monitor will be executed by a BIG-IP in the same datacenter as the server/virtual server that is being monitored. Also, GTM will rotate the monitor assignment periodically among all available BIG-IPs. See these AskF5 articles for more info: