The invention belongs to a screener and a screening method for screening information tending to enter a detection system in the technical field of network safety. The screener adopts a functional module architecture device which is formed by modulating the F P G A logical resource and includes data aggregation, packet and payload separation, screening of suspected threat data packet in a network layer and a transmission layer, output processing, preprocessing, screening of suspected threat data packet in an application layer, and software and hardware interfaces; and the screening method includes aggregation processing, separation processing, screening of suspected threat data packet in the network layer and the transmission layer, output processing, data packet preprocessing and screening of suspected threat data packet in the application layer, and finally sends the data packet containing the suspected threat information into an intrusion detection system. The screener has the advantages of compact design and strong processing capability, the load of the intrusion detection system can be greatly reduced when the screener is matched with the intrusion detection system, and the invention increases the detection efficiency and the utilization ratio of the detection system, expands the range of detection, reduces the running cost, guarantees the safe running of the network, etc.