Disclosed is a network security monitoring device, which is included in a network comprising a first entity, a second entity, a switching device provided between the first entity and the second entity, and the network security monitoring device connected to the switching device. The device comprises the port for obtaining at least one mirrored packet for at least one packet transmitted and received between the first entity and the second entity on the basis of mirroring from the switching device, and a processor for determining whether a security problem has occurred for a network associated with the first entity and the second entity on the basis of at least some of information included in the at least one mirrored packet.