The invention provides a method for detecting the number of hosts after NAT (Network Address Translation). The method comprises the following steps: classifying flow according to operating system types according to the characteristics of each operating system; determining a to-be-detected application program according to the flow corresponding to each type of operation system; for the flow corresponding to each type of operating system, counting TCP long connections contained in the application program to be detected corresponding to the flow, and determining the number of hosts correspondingto each type of operating system; and obtaining the total number of the hosts after NAT according to the number of the hosts corresponding to each class of operating systems. The method has the advantages that the detection precision is high, the processing speed is high, the occupied space is small, any data content transmitted by a user is not read, and the privacy of the user is fully protected.