A method for monitoring traffic in a network is provided. The method is used in a communication device, wherein the network is formed by switches and hosts. The method includes: collecting LLDP information, VLAN information, host NIC information and host-tenant mapping information to obtain a physical network topology and a plurality of virtual network topologies; detecting a plurality of physical link loads of the physical network topology; obtaining a target path between two of the hosts or between the switches by analyzing the virtual network topologies; selecting one of the switches on the target path to serve as a mirror switch according to the physical link load corresponding to the target path or a hop count; and receiving mirror traffic transmitted from the mirror switch, and performing packet payload analysis on the mirror traffic.