Thanks all for the reply - I found out (rather embarassingly) that even when I hit the backend server on HTTP the file transfers seem to be forced over HTTPS, as I only packet captured on port 80 on the server I missed this totally. I'll use the private key and wireshark on a client which can do the same as ssldump to decrypt the packet capture (looks like I might need to downgrade the cipher used though), doing one direct to the server & another via the F5. I reckon my initial error was what the issue and the underlying connection clised must be a red herring.
Matt
Cirrus