You can try to do an internal packet capture, and then pull the flashbackup and look at the pcap. Check the CLI and user guide
(HH-VMC1) #packet-capture
controlpath Enable controlpath capture. Captured packets are stored
in /var/log/oslog/filter.pcap. Only capture to
local-filesystem is supported.
copy-to-flash Copy captured packets to flash.
datapath Enable datapath capture. Captured packets are stored in
/var/log/oslog/datapath.pcap or mirrored out of the
controller.
destination Configure capture destination.
reset-pcap Delete old pcap files and restart active capture.