A network system comprising: A plurality of terminal devices; a plurality of hub devices that are configured to relay a data frame between the plurality of terminal devices; and a communication monitoring device that is configured to monitor communication performed by the plurality of terminal devices, the communication monitoring device and the plurality of hub devices respectively have a history memory that is configured to record therein port numbers representing ports at which data frames have arrived in the order of arrival of data frames, the communication monitoring device is configured to detect an abnormal frame from among the data frames that have arrived at the communication monitoring device, detect an order in which the abnormal frame arrived and identify a first arrival port at which the abnormal frame has arrived at the communication monitoring device by referring to the history memory provided in the communication monitoring device using the detected order, the communication monitoring device is configured to transmit a search frame including order information that indicates the detected order to a hub connected to the first arrival port, the hub device that is configured to receive the search frame refers to the history memory of the hub device according to the order information included in the search frame to identify a second arrival port at which the abnormal frame has arrived at the hub device, the hub device that is configured to receive the search frame adds port information that indicates the second arrival port to the search frame, and is configured to transmit the search frame to the communication monitoring device, and the communication monitoring device is configured to identify a source node of the abnormal frame according to the port information included in the search frame to which the port information has been added. A plurality of terminal devices; a plurality of hub devices that are configured to relay a data frame between the plurality of terminal devices; and a communication monitoring device that is configured to monitor communication performed by the plurality of terminal devices, the communication monitoring device and the plurality of hub devices respectively have a history memory that is configured to record therein port numbers representing ports at which data frames have arrived in the order of arrival of data frames, the communication monitoring device is configured to detect an abnormal frame from among the data frames that have arrived at the communication monitoring device, detect an order in which the abnormal frame arrived and identify a first arrival port at which the abnormal frame has arrived at the communication monitoring device by referring to the history memory provided in the communication monitoring device using the detected order, the communication monitoring device is configured to transmit a search frame including order information that indicates the detected order to a hub connected to the first arrival port, the hub device that is configured to receive the search frame refers to the history memory of the hub device according to the order information included in the search frame to identify a second arrival port at which the abnormal frame has arrived at the hub device, the hub device that is configured to receive the search frame adds port information that indicates the second arrival port to the search frame, and is configured to transmit the search frame to the communication monitoring device, and the communication monitoring device is configured to identify a source node of the abnormal frame according to the port information included in the search frame to which the port information has been added.