[ddelnano]

Yep, that's correct. It uses eBPF upprobes to attach to the SSL_write/SSL_read functions.