For this to work you need to decrypt the traffic as it comes in.  Its too late if you did a capture and all the traffic is encrypted.  So this entry is for those of you that would like to do some work ahead of time on the F5 and then have the user do some application testing while you are running a tcpdump.  In many cases for me, I have only needed to do this on our DMZ LTM which is where the our F5 works as an SSL Bridge

SETUP

Put the source IPs in a txt file.  I'm calling mine /var/tmp/app1_dg_nonprod_address.txt

Create a datagroup

tmsh create /sys file data-group dg.app1.nonprod separator ":=" source-path file:/var/tmp/app1_dg_nonprod_address.txt type ip

Create iRule and reference datagroup

## irule.ssl.decrypt.app1.nonprod
when CLIENTSSL_HANDSHAKE {
    if {[class match [getfield [IP::client_addr] "%" 1] equals dg.app1.nonprod] } { 
        log local0. "CLIENT_Side_IP:TCP source port: [IP::client_addr]:[TCP::remote_port]"
        log local0. "CLIENT_RANDOM [SSL::clientrandom] [SSL::sessionsecret]"
        log local0. "RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
        }
}
when SERVERSSL_HANDSHAKE {
    if {[class match [getfield [IP::client_addr] "%" 1] equals dg.app1.nonprod] } { 
        log local0. "CLIENT_Side_IP:TCP source port: [IP::client_addr]:[TCP::remote_port]"
        log local0. "CLIENT_RANDOM [SSL::clientrandom] [SSL::sessionsecret]"
        log local0. "RSA Session-ID:[SSL::sessionid] Master-Key:[SSL::sessionsecret]"
        }
}

Add iRule to Virtual Server you want to capture traffic on

Start Capture via cli where the iRule is

tcpdump -ni 0.0:nnn -s0 --f5 ssl host 198.200.19.151 or host 10.46.69.31 -w /var/tmp/app1-ext.hosangit.com_tcpdump_VS_$(date +%d_%b_%H_%M_%S)_$HOSTNAME.pcap

Start Capture via cli on downstream F5 (optional)

tcpdump -ni 0.0:nnn -s0 --f5 ssl host 10.46.69.31 or host 10.46.126.197 or host 10.46.126.242 or host 10.46.126.253 -w /var/tmp/app1-int.hosangit.com_tcpdump_VS_$(date +%d_%b_%H_%M_%S)_$HOSTNAME.pcap

BEGIN testing application to reproduce the error, once error occurs STOP captures by issuing a CTRL + C
Download .pcap file(s)

Get those secrets off the F5 that you have the iRule running

sed -e 's/^.*\(RSA Session-ID\)/\1/;tx;d;:x' /var/log/ltm > /var/tmp/app1-ext.hosangit.com-sessionsecrets_$(date +%d_%b_%H_%M_%S)_$HOSTNAME.pms

Download the sessionsecrets (.pms file) example:

/var/tmp/appi-ext.hosangit.com-sessionsecrets_$(date +%d_%b_%H_%M_%S)_$HOSTNAME.pms