A plurality of traffic monitoring apparatuses and an entry managing apparatus common to the traffic monitoring apparatuses are provided in a network. In the traffic monitoring apparatus, a packet receiving unit extracts a source IP address, destination IP address, and a TTL count to be registered in an entry registering unit as an entry. A destination-address counting unit counts the number of entries having the same source IP address and the same TTL count. A TTL counting unit counts the number of entries having the same source IP address and the same destination IP address, and counts a largest TTL count. An entry reporting unit reports a TTL count or a largest TTL count to the entry managing apparatus. The entry managing apparatus identifies a traffic monitoring apparatus that has reported a TTL count having the largest value or a largest TTL count having the largest value, as an origin of an abnormality.