This paper provided a real-time network monitor system based on WinPcap, which supported packet level and flow level traffic metrics such as link utilization, protocol distribution in 2-7 protocol levels, various aggravated flow distribution, top NIP host