The routing protocol is composed of multiple protocols at different levels. The current routing protocol attack monitoring system can not obtain a large number of data packets from the data link layer between the routing protocol layers, so that the system can not realize the data acquisition in a short time and Transmission, there is a low bandwidth occupancy, long response time, high bit error rate. This paper proposes a routing protocol attack monitoring system architecture, which analyzes the routing protocol and controls the data acquisition frequency without affecting the efficiency of monitoring. The bandwidth of the system is reduced. The connection between the network data acquisition filter and the tap and the signal The processing of the number of errors in the bit to do a more detailed description of the design of the information release, and the description of the rules of the packet. The experimental results show that the system has short response time, low bandwidth occupancy rate and low bit error rate.