As use of Internet has grown, wired/wireless network backbone and access network has speed up, network environment get composed complexity. Recently network fault is often happened by worm virus, and then the major reason is anomaly traffic flowed from host inside rather than attack from out-side. In this paper, using monitoring the load of network node and detecting abnormally signs about anomaly traffic, we try to design and implement auto-matic system which can trace the location for the affected system