The FWC 7 identifies, for example, the FW #1 corresponding to the sub-network #1 including the transmission source address=“IP#1” of the flow A. In addition, the FWC 7 additionally sets, for the relevant FW #1, a discarding entry for discarding packets each having a transmission source address=IP#1, a destination address=IP#4, a protocol type=TCP, and a port number=56. The already-described entry setting request message (see FIG. 2) may be used for the additional setting of the discarding entry for the FW #1.

Note that the totalization of the discarded-packet information may be implemented by the FWC 7 or may be implemented by each of the FWs #x. In addition, analysis processing of a totalization result may be implemented by the FWC 7 or may be implemented by each of the FWs #x.

The analysis processing may exemplarily include threshold value determination processing of the discarded-packet information and generation processing of discarding entry information, based on a result of the relevant threshold value determination processing. One or two of the threshold value determination processing and the generation processing of the discarding entry information may be implemented by one of the FWC 7 and the FWs #x.

In a case where the totalization of the discarded-packet information is implemented by the FWC 7, the FWC 7 receives and collects, from each of the FWs #x, the discarded-packet information collected by the relevant FW #x. Each of the FWs #x may regularly or irregularly address, to the FWC 7, and transmit the collected discarded-packet information, for example. In response to the transmission of the discarded-packet information, the relevant FW #x may delete the collected discarded-packet information.