The invention discloses a TCP connection managing method for an internet bypass monitoring system. The method comprises the following steps: the monitoring system receives a data packet after the finish of initialization and searches the connection corresponding to the data packet according to the data packet; if a connection node corresponding to the data packet is found, the connection state ofthe node is set; if no connection node corresponding to the data packet is found, application layer data processing is carried out, the connection node is established according to an application layer protocol found according to a processing result, and the established connection node is added into an overtime alignment; the connection state of the node is set and examined, and if the connection state changes into a finish state, the connection node is deleted and the overtime alignment is updated; if the connection state does not change into the finish state, a timer maintained by the connection node is updated and time length of the timer is set according to the state of the connection node; whether the overtime alignment needs examining is judged, and if so, the overtime connection node is examined and deleted. The method realizes the convenient management of the TCP connection monitored by the monitoring system.