Research on Netstat

I am basically trying to check if there is a vncviewer connecting to a vncserver through SSH.

So my first stop was really to play around with netstat. And I found a very interesting behaviour when vncviewer is connecting to a vncserver through an SSH tunnel.

Setup:
I started port forwarding: SSH -L 10001:localhost:5900
Then. with the command: netstat -t grep

Observations:
1.) When RECV-Q is = 0, it means there is no user activity in SSH
2.) When RECV-Q is > 0, it means there is user activity
3.) When SEND-Q is = 0 or > 1504, it means SSH connection is active and host is alive.
4.) When SEND-Q is = 1504, it means SSH connection is active, but host is dead.