The provided collecting and analyzing method for network flow comprises: learning BGP route message, collecting network flow message; looking up the corresponding BGP route for current flow from learnt BGP route message, and comparing this BGP route with the network flow message; if the message contains the BGP route message, calculating the message. The relative device comprises a learning module, a collecting module, and a analyzing module. This invention simplifies the analysis, and overcomes defects in current technology.