The invention provides a TCP (Transmission Control Protocol) connection establishing method and device. The method is applied to a network device. The method comprises the steps of receiving TCP connection requests sent by user side devices; searching whether there are first sockets in a monitoring socket queue or not, wherein the first sockets match with the five-element information of the TCP connection requests and carry preset identifiers; establishing second sockets according to the first sockets when the first sockets are searched; and establishing TCP connections with the user side devices based on the second sockets. Through application of the method and the device provided by the embodiment of the invention, the network device can monitor connections and data under multiple VRFs (Virtual Private Networks) through establishment of the public monitoring sockets with the preset identifiers, the processing complexity of the upper layer applications of the network device is greatly mitigated, and a large number of socket resources are saved.