Probably because it relies on eBPF rules on Linux?