When you say host do you mean the OS / linux level?
I have netstat on Ubuntu OS but I thought I needed it in the container (where all the magic happens right, with nginx etc) if I understand things correctly.
As was trying to gauge if our droplet is having a similar even the same issue as this other user case Discourse overloaded real traffic or DDOS? 100% CPU usage despite of decent traffic and high specs server