A VPN (Virtual Private Network) communication detecting apparatus connecting to an internal network for detecting a VPN node on an external network which connects to the internal network through a relay apparatus, transmits response request packet to test target node, receives response packet from the test target node in response to the response request packet, measures response time which is from first time point when the response request packet is transmitted to second time point when the response packet is received, and determines whether the test target node is the VPN node, based on correlation between the response time and delay time inserted by the relay apparatus when test target packet pass through the relay apparatus, the test target packet, if the test target node is the other of the VPN nodes, including the response request packet or the response packet.