rate(node_netstat_Tcp_EstabResets[1m])

Warning: some of updates have "Series fetched" equal to 0.
It might be that either this data is missing in the datasource or there is a typo in rule's expression. For example, foo{label="bar"} > 0 could never trigger because foo{label="bar"} metric doesn't exist.
Rule's expressions without time series selector, like expr: 42 or expr: time() aren't fetching time series from datasource, so they could have "Series fetched" equal to 0 and this won't be a problem.
See more details about this detection here.