Skip to main content
Last Updated: December 2025 This page provides an honest assessment of what OISP Sensor can capture today.

​
Platform Support

PlatformStatusWhat Works
Linux✅ Production ReadyFull SSL/TLS capture via eBPF, process attribution
Docker✅ Production ReadySame as Linux (requires privileged mode)
Kubernetes✅ Production ReadyDaemonSet deployment
macOS🧪 BetaNetwork Extension with TLS MITM, needs testing
Windows🧪 BetaWinDivert + TLS proxy, needs testing
macOS and Windows implementations are complete but need more real-world testing. We welcome feedback from beta testers!

​
Linux: Production Ready

​
Supported Distributions

  • Ubuntu 22.04 LTS, 24.04 LTS
  • Debian 12 (Bookworm)
  • Fedora 39, 40
  • RHEL / Rocky / Alma 9.x

​
System Requirements

RequirementDetails
Kernel5.8+ recommended (5.0+ works)
Architecturex86_64, aarch64
PrivilegesRoot or CAP_BPF + CAP_PERFMON + CAP_SYS_ADMIN
BTFRequired (CONFIG_DEBUG_INFO_BTF=y)

​
What’s Captured

Event TypeStatusDescription
ai.request✅AI API requests with model, messages, tools
ai.response✅Responses with content, tool calls, token usage
agent.tool_call✅Tool invocations extracted from responses
process.exec✅Process execution and termination
network.connect✅Outbound TCP connections
file.open✅File operations

​
macOS: Beta

​
What’s Implemented

ComponentStatusDescription
Network Extension✅ DoneNETransparentProxyProvider for traffic interception
TLS Interceptor✅ DoneMITM proxy with dynamic certificate generation
Certificate Authority✅ DoneLocal CA for signing intercepted connections
AI Endpoint Filter✅ DoneFilters traffic to AI provider domains
Process Attribution✅ DoneIdentifies which app made each request
Menu Bar App✅ DoneSwiftUI app for status and control
Unix Socket Bridge✅ DoneIPC with oisp-sensor Rust binary

​
Requirements

  • macOS 13.0 (Ventura) or later
  • Apple Silicon (M1/M2/M3/M4) or Intel
  • Admin access for extension approval
  • Trust OISP CA certificate

​
What Needs Testing

  • Long-running stability
  • Edge cases with different AI SDKs
  • Certificate trust flow UX
  • Memory usage under load

​
Windows: Beta

​
What’s Implemented

ComponentStatusDescription
System Tray App✅ DoneWPF app for status, settings, control
WinDivert Integration✅ DoneKernel-level packet interception
TLS MITM Proxy✅ DoneTransparent proxy with certificate generation
Certificate Service✅ DoneCA installation to Windows trust store
Redirector Service✅ DoneElevated process for packet capture
AI Endpoint Filter✅ DoneRoutes AI traffic through proxy
Named Pipe IPC✅ DoneCommunication between components

​
Requirements

  • Windows 10/11 (64-bit)
  • Administrator privileges
  • ~50 MB disk space
  • Trust OISP CA certificate

​
What Needs Testing

  • Different Windows versions
  • Antivirus compatibility
  • UAC elevation flow
  • Long-running stability

​
SSL/TLS Library Support (Linux)

SSL LibraryStatusNotes
OpenSSL 3.x✅ WorksSystem library, most common
OpenSSL 1.1.x✅ WorksOlder systems
OpenSSL (static)⚠️ Config neededAdd binary path to config
BoringSSL⚠️ PartialDifferent symbols, may not work
GnuTLS❌ Not supportedDifferent API
Go crypto/tls❌ Not supportedPure Go implementation
Rust rustls❌ Not supportedPure Rust implementation

​
Check Your Application

# Check what SSL library your app uses
ldd /path/to/your/binary | grep -E "(ssl|crypto)"

# For Python
python3 -c "import ssl; print(ssl.OPENSSL_VERSION)"

# For Node.js
node -e "console.log(process.versions.openssl)"

​
Language/Runtime Support (Linux)

RuntimeSSL LibraryWorks?Notes
Python (system)System OpenSSL✅ Yes/usr/bin/python3
Python (pyenv)May compile own⚠️ MaybeAdd path to config
Python (conda)Bundles own⚠️ MaybeAdd conda lib path
Node.js (system)System OpenSSL✅ Yesapt install nodejs
Node.js (NVM)Static OpenSSL❌ NoRequires config
Go applicationscrypto/tls❌ NoNot supported
Rust (native-tls)System OpenSSL⚠️ MaybeIf dynamically linked
Rust (rustls)rustls❌ NoNot supported
JavaJSSE❌ NoNot supported
RubySystem OpenSSL✅ YesUsually works

​
AI Provider Support

All platforms support the same AI providers:
ProviderDomainParsing Level
OpenAIapi.openai.comFull
Anthropicapi.anthropic.comFull
Google Geminigenerativelanguage.googleapis.comFull
Azure OpenAI*.openai.azure.comFull
DeepSeekapi.deepseek.comFull
Ollamalocalhost:11434Full
LM Studiolocalhost:1234Full
AWS Bedrockbedrock-runtime.*.amazonaws.comBasic
Mistralapi.mistral.aiBasic
Cohereapi.cohere.aiBasic
Groqapi.groq.comBasic
Togetherapi.together.xyzBasic
Fireworksapi.fireworks.aiBasic
Perplexityapi.perplexity.aiBasic
OpenRouteropenrouter.aiBasic
Replicateapi.replicate.comBasic
Hugging Faceapi-inference.huggingface.coBasic
xAI (Grok)api.x.aiBasic
Full: Request parsing, response parsing, tool calls, token usage Basic: Provider detection, model extraction, request/response metadata

​
Known Limitations

​
Large Responses (Linux)

eBPF has buffer size limits. Very large responses (>16KB per chunk) may be truncated.

​
Streaming (SSE)

Server-Sent Events are captured per-chunk and reassembled. Very fast streams may not parse correctly.

​
Static OpenSSL (Linux)

Applications that statically link OpenSSL require manual configuration: 
# ~/.config/oisp-sensor/config.toml
[capture.ssl]
binary_paths = [
    "~/.nvm/versions/node/*/bin/node",
]

​
Not Yet Implemented

FeatureStatusNotes
Cost calculationPlannedToken counts captured, pricing lookup not implemented
User attributionPlannedAuth header parsing for account identification
HTTP/2LimitedSome traffic may be missed
gRPCNot supportedAffects Google Cloud AI
WebSocket AI APIsLimitedPartial support
Full trace correlationPlannedBasic correlation works

​
Verified Scenarios

ScenarioLinuxmacOSWindows
Python + OpenAI SDK✅🧪🧪
Python + Anthropic SDK✅🧪🧪
Python + LangChain✅🧪🧪
Node.js + OpenAI SDK✅🧪🧪
FastAPI + OpenAI✅🧪🧪
Docker containers✅N/AN/A
✅ = Verified working | 🧪 = Needs testing | N/A = Not applicable

​
Getting Help

If something doesn’t work:
  1. Check requirements for your platform
  2. Run with debug: RUST_LOG=debug oisp-sensor record
  3. File an issue with platform, version, and debug logs