Take a look at Core Feature #2 in this post - https://deepflow.io/ebpf-the-key-technology-to-observability/#0x2-Three-Core-Features-of-DeepFlow-Based-on-eBPF ht

Take a look at Core Feature #2 in this post - https://deepflow.io/ebpf-the-key-technology-to-observability/#0x2-Three-Core-Features-of-DeepFlow-Based-on-eBPF https://deepflow.io/ebpf-the-key-technology-to-observability... It looks like it's using tcp flow tuple + tcp_seq to join things.