IRule-XFforwar4 , for non HTTP resquests

Hello guys

I´m trying to detect a original ip address that conect on our server but in a non HTTP or HTTPS request, in this case a 9000 port.

Normally id use XFF profile to detect this original source ip, but didn´t work.

In my thoughts this type of traffic to track probally i will need to use a IRULE.

How can i compose this irule ?

Hughes from Brazil