Abstract: The purpose of the present invention is supplying a packet tracing system which can trace a route of a packet using existing network components. Packet printing devices 1a, 1b, and 1c generate packet identifying information for each packet which transmits through the communication line and write the packet identifying information to a storage part. An IDS 3 detects suspicious packets in a network under surveillance. A management system which receives a suspicious packet in a network generates a hash value for the suspicious packet and sends a request for examination which contains the hash value to the packet printing devices 1a, 1b and 1c. The packet printing devices 1a, 1b and 1c examine an internal storage part and send a result of examination to the management system 2. The management system 2 obtains a transmission route of the suspicious packet to be traced and by the result of examination and information of network construction.