Tracking hacker using iRule and Honeypot

Perhaps investigate mirroring on the F5? At least in v4 you were able to mirror connections on a VIP to a specific port, should still be able to do it with v9, just haven't looked.

 

 

At any rate, in terms of iRules with a Honeypot, I personally have not messed with this, other than checking the URI requests for a few security related issues that could mean a potential attack. Be interested to see what others have done.