In order to solve the problem that most of the existing network monitoring system can not support the display of process layer network topology and virtual connection circuit, this paper proposes a network monitoring online system based on the process layer switch. The system includes the host monitoring system and the process layer switch. The host monitoring system obtains the preset process level network topology and virtual connection logic circuit by parsing the SCD file. The process layer switch uses the ACL rule to capture and parse certain GOOSE and SV packets to obtain the device information connected to the switch. Then the host monitoring system obtains the actual process level network topology and the virtual connection physical circuit.Real-time monitoring and fault location of the process layer network are realized by comparing preset and catual network topology and virtual link loop. In practical applications, the system assists power system operation and maintenance personnel in real-time monitoring of network operation status and fault location, and improves the management level of power system automation operation and maintenance.