A network monitoring method, comprising: receiving a packet transmitted on a network, wherein the packet has flow information that indicates a network flow for transmission of the packet; acquiring the flow information of the packet; detecting whether a metadatabase comprises the flow information corresponding to the packet, wherein the metadatabase is used to store metadata and flow information associated with the metadata; generating, according to a detection result about the flow information, metadata related to the transmission of the packet, and associating the metadata with the corresponding flow information; and storing the generated metadata and the flow information associated with the generated metadata into the metadatabase, wherein: the metadata comprises a source address-destination address pair, a source port-destination port pair, a source-end sub-network identifier, a destination-end sub-network identifier, a packet flow direction, a service type identifier, a protocol identifier, an application identifier and/or a VLAN identifier; the method being characterized in that: the received packet is one packet in a group of packets transmitted on the network, and the network monitoring method comprises: receiving the group of packets; if each packet in the group of packets is allocated with corresponding metadata in the metadatabase, adding, to the group of packets, a block tag indicating that each packet is allocated with corresponding metadata; using a metadata filter to filter the group of packets having the block tag. receiving a packet transmitted on a network, wherein the packet has flow information that indicates a network flow for transmission of the packet; acquiring the flow information of the packet; detecting whether a metadatabase comprises the flow information corresponding to the packet, wherein the metadatabase is used to store metadata and flow information associated with the metadata; generating, according to a detection result about the flow information, metadata related to the transmission of the packet, and associating the metadata with the corresponding flow information; and storing the generated metadata and the flow information associated with the generated metadata into the metadatabase, wherein: the metadata comprises a source address-destination address pair, a source port-destination port pair, a source-end sub-network identifier, a destination-end sub-network identifier, a packet flow direction, a service type identifier, a protocol identifier, an application identifier and/or a VLAN identifier; the method being characterized in that: the received packet is one packet in a group of packets transmitted on the network, and the network monitoring method comprises: receiving the group of packets; if each packet in the group of packets is allocated with corresponding metadata in the metadatabase, adding, to the group of packets, a block tag indicating that each packet is allocated with corresponding metadata; using a metadata filter to filter the group of packets having the block tag. the metadata comprises a source address-destination address pair, a source port-destination port pair, a source-end sub-network identifier, a destination-end sub-network identifier, a packet flow direction, a service type identifier, a protocol identifier, an application identifier and/or a VLAN identifier; the method being characterized in that: the received packet is one packet in a group of packets transmitted on the network, and the network monitoring method comprises: receiving the group of packets; if each packet in the group of packets is allocated with corresponding metadata in the metadatabase, adding, to the group of packets, a block tag indicating that each packet is allocated with corresponding metadata; using a metadata filter to filter the group of packets having the block tag. receiving the group of packets; if each packet in the group of packets is allocated with corresponding metadata in the metadatabase, adding, to the group of packets, a block tag indicating that each packet is allocated with corresponding metadata; using a metadata filter to filter the group of packets having the block tag.