A relay device coupled to a network including a plurality of information processing devices, the relay device includes a port coupled to any one of the plurality of information processing devices, and a processor coupled to the port and configured to specify a first number which is a number of packets of a first communication protocol transmitted from the port, specify a second number which is a number of packets of the first communication protocol received at the port, and determine, based on comparison of a ratio of the first number and the second number and a threshold corresponding to a third number which is a number of the plurality of information processing devices included in the network, whether an attack by at least one information processing device of the plurality of information processing devices occurs.