This invention provides a detection method, the method including: intercepted information handshake send by the observed host to the purpose , the delivery of Monitoring was sent to the mainframe with timestamp handshake feedback information; intercepted the confirmation timestamp feedback by observed host and extract from the first key value; intercepted the direction feedback information feedback by host and extract from the second key value; to change the content of handshake for the purpose can receive and send handshake to the purpose of the confirmation information; the purpose was intercepted and monitoring between the mainframe data packet transmission, the data packets will be part of the agreement referred to by the contents of the first or second key value changes under surveillance for the purpose mainframe or to the right to receive the content, and transponders; corresponding to this method, but also provides a host of the number of devices, the device including: units intercepted information changes modules, sending units and calculation modules .