A network monitoring system capable of effectively monitoring the behavior of traffic through a network is provided with an aggregation apparatus which is connected to access networks which is connected to a telecommunications network. The aggregation apparatus includes: a receiving unit distinctively receiving input side communication data which is input from the telecommunications network to one of the access network and output side communication data which is output from one of the access network to the telecommunications network; and an abnormal traffic detecting unit detecting abnormal traffic on the basis of both the input side communication data and the output side communication data.