The data transferring on health-care network has a sensitive data such as personal medical information, genome, and so on. So it is very important to make secure network, and there are potential targets to infect when the next vulnerability announces. And hacking or worm virus uses several vulnerability to drain important information. Also it attacks security program for personal computer such as vaccine, personal firewall, etc. Recently network fault is often happened by worm virus, and then the major reason is anomaly traffic flowed from inside host rather than attack from outside. In this paper, we try to design and implement automatic system which can trace the location for the infected system using monitoring load of network node and detecting signs of anomaly traffic.