10:20:37.00749: IP 199.16.255.254.36664>10.0.1.10 http : flags (s) seq 700424862, Win 29200 A website is fronted by a toad balancer that implements a full proxy architecture with SNAT enabled Behind t

Node2 is a sibling backend pool member and would not be the source of a new inbound HTTP SYN packet arriving at Node1 under normal load balancing operation.

Node1 is the device where tcpdump is running - it cannot be the source of a packet it is receiving from the network.

When SNAT is enabled on a BIG-IP full proxy, the device replaces the original client's source IP address with its own SNAT IP before forwarding the connection to the selected backend node. This means that the source IP observed in the tcpdump on Node1 (199.16.255.254 in the capture) belongs to the load balancer, not the web client. This is a defining behavior of SNAT - backend servers never see the real client IP unless an X-Forwarded-For header or iRule is used to preserve it.

The web client's original source IP is hidden from Node1 because SNAT replaces it with the load balancer's address before the packet is forwarded to the backend.