Looking for ideas on tracing traffic...

have you used the p option in the tcpdump? to capture the client IP or VIP and it will include the backend pool connection With version 11.2 feature –p captures the peer server side connection with just the client ip in the command! This link has more details http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13637.html This example shows how the command looks with a single client. tcpdump -ni 0.0:nnnp -s 0 host 192.168.1.2 -w /var/tmp/trace1.pcap