(With the development of computer technology, network has increasingly become an indispensable tool in life, but the accompanying illegal intrusion has always threatened the security of computer network system. Because the LAN adopts broadcast mode, all packets can be monitored in a broadcast domain. By analyzing the packets, hackers can obtain some important information transmitted on the LAN. In fact, many hackers take LAN scanning and listening as their most basic steps and means when they invade, because they want to use this method to obtain the password and other information they want. On the other hand, we can also use network monitoring technology to obtain necessary information when investigating and obtaining evidence for hacker intrusion and other network crimes. Therefore, it is particularly important to understand the principle, implementation methods and preventive measures of Ethernet monitoring technology.)