Method and device for detecting network flow

The invention provides a method for detecting network flow. The method comprises the following steps of: acquiring all the data packets flowing through a network flow detection position within set time, sequentially extracting attribute information of the data packets, generating flow cell tables (FCT) corresponding to the data packets, and sampling the FCTs; and sequentially analyzing and processing the FCTs acquired by sampling according to a preset analyzing rule, and updating flow stastic tables (FST) stored in a storage according to an analyzing result of the FCTs. The network flow flowing through the detection position is detected by the method and the device for detecting the network flow to obtain flow statistic information which provides basis for the subsequent flow collector to perform attribute analysis on the network flow, the network flow is collected without the assistance of a central processing unit (CPU), and the processing performance and the normal operation of a system are ensured and are not affected.