[tuetuopay]

you could try ebpf and hook on the socket syscall. might be harder than LD_PRELOAD as suggested by other commenters though