Hi
Thank for help!
10.12.1.1 is the Client while 172.17.40.21 is the server.
the VIP used in F5 is 172.17.20.11 where SNAT is used in Client server. to translate the src ip of the packet going to 172.17.20.11 is 10.12.1.1.
17:07:11.419810 IP 10.12.1.1.33517 > 172.17.20.11.telnet: S 3365755525:3365755525(0) win 5840
17:07:11.420746 IP 172.17.40.21.telnet > 10.12.1.1.33517: S 3197962301:3197962301(0) ack 3365755526 win 5792
17:07:14.419010 IP 10.12.1.1.33517 > 172.17.20.11.telnet: S 3365755525:3365755525(0) win 5840
17:07:14.419683 IP 172.17.40.21.telnet > 10.12.1.1.33517: S 3197962301:3197962301(0) ack 3365755526 win 5792
17:07:14.587769 IP 172.17.40.21.telnet > 10.12.1.1.33517: S 3197962301:3197962301(0) ack 3365755526 win 5792
17:07:20.586801 IP 172.17.40.21.telnet > 10.12.1.1.33517: S 3197962301:3197962301(0) ack 3365755526 win 5792
-rk