If I understand your question properly, I think what you should be looking to do is either a tcpdump or use the CS-Command that generates a tabular
output and gives you information on the following:
When using the tcpdump in this case, you may want to include the option were the output is written to a file. I recommend this because
you can examine this file with ethereal which is a bit more user friendly and enables you to filter on a lot more things you might
be in search of. The syntax to do this is as follows:
USING TCPDUMP
tcpdump -vvni 0.0:nnn -s0 host 1.1.1.1 or host 2.2.2.2 or host 3.3.3.3 -w /var/tmp/FILENAME.pcap
OR
tcpdump -nvvv -i any -c 20 '((port 80 or port 443) and (host 10.0.3.169 or host 10.0.3.1)) and dst host 10.0.3.246' > FILENAME
The tcpdump should be used cautiously, it uses system processor cycles if not used well.
NOTE: The ( -c 20) above in the command will output only 20 lines of the result, without this switch, an endless stretch of output is obtained.
the use of this is to cut down on the cycles used, this can be repeated several times to accumulate volume of information obtained. Unless that
is not problem on the network it is used.
USING THE CS-SERVER COMMAND:
The below commands can be use from the perspective of client side and the server side with different options available, further below, I took the liberty
to include the explanations of all the possible combinations of these commands (obtained from F5 site). Also, the output of the command is broken into 5
parts, below is also an explanation of what the output translates to.
tmsh show sys connection cs-server-addr
tmsh show sys connection ss-server-addr
(1) (2) (3) (4) (5)
X.X.X.X:64231 X.X.X.X:443 X.X.X.X:64231 X.X.X.X:443 tcp 21 (tmm: 7) none
Y.Y.Y.Y:49632 Y.Y.Y.Y:443 Y.Y.Y.Y:49632 Y.Y.Y.Y:443 tcp 16 (tmm: 0) none
The Client IP Address and Port (1)
The Virtual Server IP Address and Port (2)
The SelfIP (SNAT) Address and Port (3)
The IP Address and Port of the Member Server the request went to (4)
The tmm process processing the connection (5)
cs-client-addr Specifies the clientside remote address of the active connections
cs-client-port Specifies the clientside remote port of the active connections
cs-server-addr Specifies the clientside local address of the active connections
cs-server-port Specifies the clientside local port of the active connections
protocol Specifies the protocol used for specified connections (for example: tcp, udp)
ss-client-addr Specifies the serverside local address of the active connections
ss-client-port Specifies the serverside local port of the active connections
ss-server-addr Specifies the serverside remote address of the active connections
ss-server-port Specifies the serverside remote port of the active connections