The invention relates to the technical field of network data packet sorting, in particular to a multi-data packet file bubble sorting method, which comprises the following steps of: preliminarily reading files, preliminarily sorting the files, dividing time batches, sequentially reading the files according to the time batches, and performing file bubble sorting in sequence. According to the technical scheme, the data messages in the data packet file are reordered completely according to real moments, so that subsequent attack behavior discovery and redisk are facilitated; in order to avoid too many file handles opened at the same time, part of files needing to be concerned are selectively opened according to batches, and resource waste caused by the file handles irrelevant to time is avoided; according to the method, the pre-reading strategy is executed for each data packet file, the participated sorting process is carried out in the memory, the sorting efficiency is high, the data packet files are recombined after being split, the sizes of the files participating in bubble sorting are limited, and a good foundation is laid for rapidly sorting and replaying the multiple data packet files.