DDoS attacks are a major threat to internet and almost all of DDoS attacker use TCP Flooding attacks. Based on lots of studying, a network monitoring machine is presented. The machine can detect TCP Flooding attacks for local area network and solve problems of other security production.