This paper proposes a high-order terminal sliding-mode observer used for the anomaly detection in TCP/IP networks. It can track the fluid-flow model representing the TCP/IP behaviors in a router level. A smooth control signal of the observer can be generated based on the high-order sliding-mode technique for estimation of the queue length dynamics in the router. The distributed anomaly in the TCP/IP network incurred by an abnormal behavior can be detected using the smooth control signal. The proposed scheme requires only the average queue length in a router for anomaly detection. The simulations are presented to verify the effectiveness of the proposed method.