A monitoring apparatus includes: a user input acquirer that acquires information based on input provided by a user to a user input device; and a communication anomaly detector that detects a communication anomaly in communication that is being observed, and the communication anomaly detector detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device and the information based on the input corresponding to the packet.