Network monitoring is a management tool to monitor network status, data flow and information transmission on the network. It can set the network interface to monitoring mode and intercept the information transmitted on the network. That is to say, when a hacker logs on to a network host and obtains the super user authority, if he wants to log on to other hosts, he can use network monitoring to intercept the data on the network effectively, which is the best way for hackers to use.

When computers communicate with each other, there are two ways: one is to confirm whether the information has arrived after sending, that is, there is a reply, and TCP protocol is often used. In TCP transmission control protocol, the establishment of end-to-end connection depends on the interaction between IP address and TCP port number. One is to leave it alone after sending it, and not confirm whether the information has arrived. This method mostly adopts UDP protocol, and UDP also uses port number to connect.

The so-called port monitor means that after receiving an IP packet, the host network process checks whether its destination port is its own port number, and if so, receives the packet for processing. The host communicating on the network not only sends data, but also receives data, so it is necessary to open the corresponding port to receive data. A host on the network may start multiple network processes, that is, listen to multiple ports.