<p>I am using this command in linux  to see (currently) established TCP connections:</p>
<pre><code>netstat -ant | grep ESTABLISHED | wc -l 
</code></pre>
<p>How can i translate this command to PromQL (per node)  ?</p>
<p>I am using prometheus with node exporter in my kubernetes cluster</p>

<p>To get number of currently open TCP connections, you can use <code>node_netstat_Tcp_CurrEstab</code> (Gauge) metric.</p>
<p>you can also use <code>node_netstat_Tcp_ActiveOpens</code> (Counter) metrics with appropriate rate such as</p>
<p><code>rate(node_netstat_Tcp_ActiveOpens[10m])</code></p>
<p>These metrics are based on <a href="https://datatracker.ietf.org/doc/html/rfc4022" rel="noreferrer">TCP-MIB (RFC-4022)</a> and they are obtained by parsing <code>/proc/net/netstat</code> and <code>/proc/net/tcp</code> files on every node running exporter.</p>
