I'm working on a script to detect LLM traffic.

It works well for programmatic access (e.g., Python, JavaScript, etc.) but doesn't capture any traffic from browsers.

Do you have any idea what might be causing this issue?

https://github.com/aguru-safeguard/zeek-llms/blob/main/llm_traffic_monitor.zeek