I am running a tcpdump filtered for the scr ip and with a 50byte capture.
i understand support engineer would prefer full packet size (-s0) and end-to-end (client to server) capture with extended tmm data (:nnn).
e.g.
tcpdump -nni 0.0:nnn -s0 -w /var/tmp/output.pcap
sol13637: Capturing internal TMM information with tcpdump
https://support.f5.com/kb/en-us/solutions/public/13000/600/sol13637.html
to continuously run it, you may check whether -C and -W are useful.
-C Before writing a raw packet to a savefile, check whether the file is currently larger than file_size and, if so, close the current savefile and open a new one. Savefiles after the first savefile will have the name specified with the -w flag, with a number after it, starting at 1 and continuing upward. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
Note that when used with -Z option (enabled by default), privileges are dropped before opening first savefile.
-W Used in conjunction with the -C option, this will limit the number of files created to the specified number, and begin overwriting files from the beginning, thus creating a ârotatingâ buffer. In addition, it will name the files with enough leading 0s to support the maximum number of files, allowing them to sort correctly.
or icall if there is something can trigger it.
iCall - All New Event-Based Automation System by Jason Rahm
https://devcentral.f5.com/articles/icall-all-new-event-based-automation-system