The utility model relates to the technical field of internet systems, in particular to a station area network behavior monitoring system. The system comprises a mirror image monitoring device, the mirror image monitoring device is connected with an internal network through a switch, the system further comprises a network isolation device, and the switch is connected with an external network through the network isolation device; the mirror image monitoring device comprises an interface circuit, the interface circuit is connected with an FPGA module, and the FPGA module is connected with a processor and a memory. The station area network behavior monitoring system provided by the utility model can better monitor the external network behavior, so that the station area is safer.