This page is simply to provide quick and dirty notes for performing standard packet captures on F5 appliances.   I use these fairly often and needed a place for quick reference.  Always refer to vendor documentation for more detail.

TCPdump

F5 utilizes tcpdump for packet captures.  You need to be in bash when running tcpdump.  If your SSH session is dropping you in tmos shell, go ahead and move over to the bash shell:

run /util bash

Here are some tcpdump examples:

-s0 = Capture entire packet (change 0 to some other number to slice packets)
-nn = Disables name lookups for host and port 
-i = interface (0.0 means all interfaces)
-v = verbose
-l = buffered
-X = Print hex and ascii format

# Print straight to the screen, don't slice packets
tcpdump -nni 0.0 -X -s0 host X.X.X.X and port 80 and host Y.Y.Y.Y

# Capture filter to a file
tcpdump -v -l -s0 -nni 0.0 host X.X.X.X or host Y.Y.Y.Y or icmp or arp -w /var/tmp/cap1.pcap
 
# Specific 1.1 interface, only sourced packets
tcpdump -v -l -s0 -nni 1.1 src host X.X.X.X -w /var/tmp/cap1.pcap

Reference

https://support.f5.com/kb/en-us/solutions/public/0000/400/sol411.html

Stream TCPdump from the F5 directly to Wireshark

Yes, you can actually use Wireshark directly when performing packet capture on an F5, just make sure you have solid filters setup beforehand.  

Reference:

The examples below are from this article on devcentral:
https://devcentral.f5.com/articles/running-wireshark-captures-from-f5-big-ip

cygwin on Windows

# ssh -l root 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" | 
/cygdrive/c/Program\ Files/Wireshark/Wireshark.exe -k -i -  

Linux

# ssh -l root 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" |
/usr/bin/wireshark -k -i -  

Windows CMD with plink (download from putty homepage):

plink.exe -l root -pw default 192.168.1.245 "tcpdump -w - -s0 -pi 0.0 tcp or udp or icmp" |
 "c:\Program Files\Wireshark\wireshark.exe" -k -i - 
 

More information on TCPdump

http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/tcpdump.8?query=tcpdump&sec=8