(Currently amended) A method for blocking communication of a target apparatus (Ci) based on port information of one or more Layer-2 switches connected to communication apparatuses in a network, comprising: a first step of generating a MvP table consisting of a first mapping table and a second mapping table based on management information collected from the Layer-2 switches by a network monitoring manager, wherein said first mapping table provides a mapping between MAC address M(Ci) of the target apparatus (Ci), where 1 ≦ i ≦ total number of communication apparatuses in network, and port information set Row{M(Ci)} of Layer-2 switches (Sj)Sj, where 1 ≦ j ≦ total number of Layer-2 switches, that detected said MAC address M(Ci), and said second mapping table provides a mapping between MAC address M(Sj) of Layer-2 switches (Sj) and port information set Row{M(Sj)} of Layer-2 switches (Sj) that detected said MAC address M(Sj); a second step of normalizing the MvP table, wherein, if the same port is seen in both the port information set Row{M(Ci)} of the first mapping table and the port information set Row{M(Sj)} of the second mapping table, the MvP table is normalized by deleting elements of ports P(Sj,n) (1 ≦ n ≦ total number of ports of Layer-2 switches (Sj)) corresponding to the same port from the port information set Row{M(Sj)} of the second mapping table; and a third step of identifying the Layer-2 switch port connected to said target apparatus (Ci) based on the MvP table normalized in the second step; characterized in that the method further comprises: a fourth step of blocking the communication of said target apparatus (Ci) by administratively disabling the Layer-2 switch port connected to said target apparatus (Ci) based on the Layer-2 switch port identified in the third step. a first step of generating a MvP table consisting of a first mapping table and a second mapping table based on management information collected from the Layer-2 switches by a network monitoring manager, wherein said first mapping table provides a mapping between MAC address M(Ci) of the target apparatus (Ci), where 1 ≦ i ≦ total number of communication apparatuses in network, and port information set Row{M(Ci)} of Layer-2 switches (Sj)Sj, where 1 ≦ j ≦ total number of Layer-2 switches, that detected said MAC address M(Ci), and said second mapping table provides a mapping between MAC address M(Sj) of Layer-2 switches (Sj) and port information set Row{M(Sj)} of Layer-2 switches (Sj) that detected said MAC address M(Sj); a second step of normalizing the MvP table, wherein, if the same port is seen in both the port information set Row{M(Ci)} of the first mapping table and the port information set Row{M(Sj)} of the second mapping table, the MvP table is normalized by deleting elements of ports P(Sj,n) (1 ≦ n ≦ total number of ports of Layer-2 switches (Sj)) corresponding to the same port from the port information set Row{M(Sj)} of the second mapping table; and a third step of identifying the Layer-2 switch port connected to said target apparatus (Ci) based on the MvP table normalized in the second step; a fourth step of blocking the communication of said target apparatus (Ci) by administratively disabling the Layer-2 switch port connected to said target apparatus (Ci) based on the Layer-2 switch port identified in the third step.