The embodiment of the invention provides a network state monitoring method based on downlink traffic, which comprises the following steps of configuring a cache occupation instruction with a routing rule for a traffic monitoring network card, establishing a virtual network card in a virtual machine, configuring a traffic engine, receiving downlink traffic data, executing the cache occupation instruction, and caching by utilizing a downlink buffer area. monitoring an occupation state of a downlink buffer area, if the occupation state of the downlink buffer area meets a preset condition, routing a part of uncached traffic data in the downlink traffic data to an uplink buffer area for caching, creating a first task and a second task which are parallel by a traffic engine, and respectively reading the downlink flow data from the uplink buffer area and the downlink buffer area, storing the downlink flow data in the second storage space, and monitoring the network state by using the downlink flow data. Due to the fact that the cache space is expanded, the data throughput is improved, parallel tasks are used for reading and storing data, the speed and timeliness are improved, the risk of data loss is reduced, and then the reliability of monitoring through flow data is improved.