In order to eliminate the impact of network storm on IED equipment, a real-time monitoring of network storm and filtering storm packet algorithm is proposed. The performance requirements of the network storm monitoring and filtering algorithms are analyzed. Through the online monitoring of the substation network communication packets, part of the packet signature is used to classify and cumulate packets as the first hash, and the whole signature is used to judge and filter storm packets as the second hash. Meanwhile, the storm intensity and duration are calculated and alarmed. Example analysis results show that the algorithm is able to detect network storm quickly, can guarantee 100% of packets pass through in the case of network storm, and filter out the vast majority of the storm packets. The correctness and validity of the algorithm is demonstrated.