Why am I seeing Active Connections on my STANDBY LTM-3400?

Bigtop will show all connections moving through TMM. This includes HA traffic between the Active and Standby (network heartbeat, peer ID traffic, connection mirroring, etc.) Also, bigd (health check daemon) forwards it's monitor traffic through TMM and out of the switch fabric so TMM will actively track and report on this stuff.

You can always use this syntax to see all traffic moving through TMM (but be careful on a very busy box):

tcpdump -nni 0.0 -s0 -w /var/tmp/all_TMM_traffic.cap

This command show all "self" traffic, meaning traffic that originates inside the box, like monitor and HA traffic:

tmsh show sys connection type self