Abstract: A network security active detecting system for connecting to at least one client end and a server end in a network system includes a networking-judging unit for judging whether a networking request of a client end is sent to an authorized network, a security condition detecting unit for determining the security level of the client end after the networking-judging unit confirms the networking request of the client end is sent to the authorized network, a configuration exchange unit for controlling the client and server ends to negotiate for a communication protocol identified during the networking so as to determine a security service routine, a Layer 3 packet process unit for processing packets transmitted between the client end and the server end with the security service routine according to the communication protocol, and a negotiating mechanism for confirming the networking between the client and server ends for releasing system resources.