Abstract: A system and a method which are capable of: collecting packets on a network so as to generate a flow and a session in stages; performing a traffic inspection by using only a small number of packets on the basis of the generated information; and searching packets at a high speed while reducing storage capacity of a packet.