An execution procedure searching device that searches for a command sequence to be set for a plurality of devices constituting a system, wherein the execution procedure searching device is configured to: perform a first step for determining whether a simulator of the system having executed a temporary update command sequence satisfies a predetermined policy, wherein the predetermined policy is defined by a set of three, that is, a packet header, a transmission source router, and a destination router, and wherein the predetermined policy is satisfied when a packet from the transmission source router reaches the destination router, and execute, until satisfaction for the predetermined policy of the simulator, processing for: performing a second step for determining whether the simulator approaches a state where the predetermined policy is satisfied, with addition of one new candidate command of one or more new candidate commands to the temporary update command sequence on condition that the simulator does not satisfy the predetermined policy, wherein the candidate commands are related to the reachability of the packet; adding the new candidate command to the temporary update command sequence on condition that the simulator approaches the state where the predetermined policy is satisfied, with the addition of the new candidate command, or deleting a command at the end of the temporary update command sequence on condition that the simulator does not approach the state where the predetermined policy is satisfied, with addition of any one of the new candidate commands; and then returning to the first step, and perform a third step for determining whether the actual system having executed the temporary update command sequence satisfies the predetermined policy on condition that the simulator satisfies the predetermined policy, and execute processing for returning to the second step until satisfaction for the predetermined policy of the actual system, on condition that the actual system does not satisfy the predetermined policy. perform a first step for determining whether a simulator of the system having executed a temporary update command sequence satisfies a predetermined policy, wherein the predetermined policy is defined by a set of three, that is, a packet header, a transmission source router, and a destination router, and wherein the predetermined policy is satisfied when a packet from the transmission source router reaches the destination router, and execute, until satisfaction for the predetermined policy of the simulator, processing for: performing a second step for determining whether the simulator approaches a state where the predetermined policy is satisfied, with addition of one new candidate command of one or more new candidate commands to the temporary update command sequence on condition that the simulator does not satisfy the predetermined policy, wherein the candidate commands are related to the reachability of the packet; adding the new candidate command to the temporary update command sequence on condition that the simulator approaches the state where the predetermined policy is satisfied, with the addition of the new candidate command, or deleting a command at the end of the temporary update command sequence on condition that the simulator does not approach the state where the predetermined policy is satisfied, with addition of any one of the new candidate commands; and then returning to the first step, and performing a second step for determining whether the simulator approaches a state where the predetermined policy is satisfied, with addition of one new candidate command of one or more new candidate commands to the temporary update command sequence on condition that the simulator does not satisfy the predetermined policy, wherein the candidate commands are related to the reachability of the packet; adding the new candidate command to the temporary update command sequence on condition that the simulator approaches the state where the predetermined policy is satisfied, with the addition of the new candidate command, or deleting a command at the end of the temporary update command sequence on condition that the simulator does not approach the state where the predetermined policy is satisfied, with addition of any one of the new candidate commands; and then returning to the first step, and perform a third step for determining whether the actual system having executed the temporary update command sequence satisfies the predetermined policy on condition that the simulator satisfies the predetermined policy, and execute processing for returning to the second step until satisfaction for the predetermined policy of the actual system, on condition that the actual system does not satisfy the predetermined policy.