the connection from WAF to server

You can use the tcpump utility to capture the traffic on the wire. Simply use the p-modifier on the interface to capture both sides. For example 

tcpdump -ni 0.0:nnnp -s0 -c 100000 -w /var/tmp/capture.pcap host 10.0.0.1

Another option is maybe to capture all http headers like https://support.f5.com/csp/article/K42210592 describes it.