Abstract: The disclosure is related to a method and a system for extracting flow data inside a tunnel over a virtual network. The method is achieved by modifying flow tables operated in a switch. The switch extracts data of the in-tunnel flow when the data is transmitted among computers that run software switches over the virtual network. The switch conducts monitoring, metering and management of the in-tunnel flows. A virtual machine running in a computer generates a packet that is encapsulated through a tunnel protocol at a logical port. The packet is then transmitted to the switch. The switch uses the flow tables to perform packet lookups for extracting the in-tunnel flow after the packet is de-capsulated. The packet is then re-encapsulated and forwarded to a logical port of the switch that connects to a destination computer. The destination computer can acquire the original packet after de-capsulating the packet.