An apparatus for displaying network status includes a network traffic collection unit, a network status display unit and a first attack type determination unit. The network traffic collection unit analyzes packets collected from an external communication network, and outputs connection information including a source Internet Protocol (IP) address, a destination IP address and a destination port number. The network status display unit receives the connection information transmitted from the network traffic collection unit for a predetermined period, and displays the connection information in a coordinate point data form on a three-dimensional rectangular coordinate system whose three axes are assigned to a source IP address, a destination IP address and a destination port number, respectively. The first attack type determination unit detects the coordinate point data displayed on the network status display unit as a line or plane through image processing, and determines an attack type according to the type of the line or plane.