Method for identifying a present faulty node in a network having a plurality of nodes (K1,..., K6), in which the nodes (K1,..., K6) are connected to one another via respective connections (V1,..., V7) for the purpose of interchanging data packets, having the following steps of: a) selecting at least one of the nodes (K1,..., K6) as a monitored node; characterized in that the faulty node is coupled to at least one device, and the at least one device operates as a data sink and/or a data source, and also b) producing at least two observer nodes (KB1, KB2) by selecting from the plurality of nodes (K1, K3), the monitored node being excluded from the selection, in such a manner that - both incoming data traffic of a respective data packet class to the monitored node from at least one of the at least two observer nodes (KB1, KB2) - and outgoing data traffic of the respective data packet class from the monitored node to at least one of the at least two observer nodes (K1, K3) are completely determined; c) recording the incoming data traffic and the outgoing data traffic of the respective observer nodes (KB1, KB2); d) generating expected total outgoing data traffic of the monitored data packet classes of the monitored node on the basis of (i) the sum of each outgoing data traffic item produced by the respective incoming data traffic of the monitored data packet class and (ii) expected data traffic of the data source of the at least one device; e) generating a difference value (DIFF) from a difference between the outgoing data traffic and the expected total outgoing data traffic; f) detecting the monitored node as a faulty node if the difference value (DIFF) exceeds a predefinable threshold value (SWLL). a) selecting at least one of the nodes (K1,..., K6) as a monitored node; characterized in that the faulty node is coupled to at least one device, and the at least one device operates as a data sink and/or a data source, and also b) producing at least two observer nodes (KB1, KB2) by selecting from the plurality of nodes (K1, K3), the monitored node being excluded from the selection, in such a manner that - both incoming data traffic of a respective data packet class to the monitored node from at least one of the at least two observer nodes (KB1, KB2) - and outgoing data traffic of the respective data packet class from the monitored node to at least one of the at least two observer nodes (K1, K3) are completely determined; - both incoming data traffic of a respective data packet class to the monitored node from at least one of the at least two observer nodes (KB1, KB2) - and outgoing data traffic of the respective data packet class from the monitored node to at least one of the at least two observer nodes (K1, K3) are completely determined; c) recording the incoming data traffic and the outgoing data traffic of the respective observer nodes (KB1, KB2); d) generating expected total outgoing data traffic of the monitored data packet classes of the monitored node on the basis of (i) the sum of each outgoing data traffic item produced by the respective incoming data traffic of the monitored data packet class and (ii) expected data traffic of the data source of the at least one device; e) generating a difference value (DIFF) from a difference between the outgoing data traffic and the expected total outgoing data traffic; f) detecting the monitored node as a faulty node if the difference value (DIFF) exceeds a predefinable threshold value (SWLL).