This application discloses a network monitoring method and apparatus. The network monitoring method includes: receiving a packet transmitted on a network, where the packet has flow information that indicates a network flow for transmission of the packet; acquiring the flow information of the packet; detecting whether a metadatabase includes the flow information corresponding the packet, where the metadatabase is used to store metadata and flow information associated with the metadata; generating, according to a detection result about the flow information, metadata related to the transmission of the packet, and associating the metadata with the corresponding flow information; and storing the generated metadata and the flow information associated with the generated metadata into the metadatabase.