The invention relates to the field of network monitoring and discloses a network monitoring system and method. The network monitoring system comprises a switch and a monitoring server, wherein the switch is used for collecting media access control (MAC) address information of a server connected with the switch and transmitting the MAC address information to the monitoring server. The monitoring server performs matching comparison on the MAC address information and the pre-registrated and stored legal MAC address information and gives out warning information to prompt technical staff of illegally-invaded computers when the MAC address information does not accord with the legal MAC address information. In the process, people only need to set a specific server to serve as the monitoring server without additionally configuring a network management system, so that manpower, material resources and network monitoring cost are reduced.