The network relay device includes a central processing unit that includes a routing unit that executes routing of packets received from a network; a storage unit that concurrently with the routing stores packets in a predetermined storage means; and an analysis commencement means that sets the analysis commencement timing for commencement of analysis of whether packets stored in a storage means are unauthorized infiltration data and based on this timing, causes the commencement of analysis of packets stored in the storage means, the analysis to be made by an unauthorized infiltration analysis means for determining whether packets are unauthorized infiltration data.