Take a look at Core Feature #2 in this post - https://deepflow.io/ebpf-the-key-technology-to-observability...

It looks like it's using tcp flow tuple + tcp_seq to join things.