Nimbostratus
Nacreousyou can have decrypted tcpdump using this procedure which the result will be useful for analysis
https://clouddocs.f5.com/training/community/adc/html/class4/module1/lab10.html
https://my.f5.com/manage/s/article/K31793632
even with non decrypted tcpdump, wireshark can show tls session setup sequence.
at least in old version, health monitor uses management layer's network routing, which is different from what ltm traffic uses.
so, health monitor OK doesnt always mean ltm traffic can reach backend server.
Nimbostratuswhat route path normally ltm uses and how it makes the packet route decisions? if you could elaborate more on that.
Nacreousthe data plane uses routing config from the webgui Network tab