A security engineer is troubleshooting intermittent connectivity to a new internal web application. Connections sometimes succeed, but often hang after the TCP handshake. No drops are seen in 'fw ctl zdebug drop' output. The engineer suspects the issue is related to TCP stream handling by the firewall kernel. Which command should be used to inspect the state and statistics of the TCP streaming subsystem in real time?