Abstract: The present invention relates to a method for detecting Network Anomaly in network architectures based on locator/identifier split, the detection flow is as follows: initialization processing, and in ITR: processing data packets, sending a Map-Request, determining whether to send an additional Map-Request, sending the data packet, processing the Map_Reply, processing EID-to-RLOC Cache entry expired; in ETR: processing data packet, processing Map-Request, determining whether the traffic of the ITR currently sending the Map-Request is abnormal, replying to the ITR of which the query traffic is abnormal, replying to ITR of which the query traffic is abnormal. With respect to the characteristic that the network architecture based on locator/identifier split needs to query the relationship between the locator and the identifier for packet delivery, the present invention detects Network Anomaly based on query traffic instead of network data packet traffic.