how much data can be collected in irules for one connection?

I believe the limit is 4M.

There is no built-in limit for the amount of data you can collect, but if you collect a lot of data on a lot of connections, you can use up all of your box's memory. The 4M limit mentioned above is the limit of the size of a Tcl variable. So while the payload can be arbitrarily large, you can only operate on it in ~4M chunks. If you're on 10.x, you can supply an offset to TCP::payload and get the chunks that way. If you're not, then you'll have to chunk the data yourself as you collect it (put it into a set of variables and remove it from the TCP::payload and then add it all back in at the end).

yes, I'm using 10.0.1, so how can I supply an offset? is there any sample code to do that?

Just make the offset the first parameter:

 
   set first_chunk  [TCP::payload       0 1000000] 
   set second_chunk [TCP::payload 1000000 1000000] 
   set third_chunk  [TCP::payload 2000000 1000000] 
 

I thought this was in the Wiki already, but I see it isn't...