A network apparatus includes a memory and one or more processors. The memory stores instructions. The one or more processors are configured to execute the instructions to mark a traffic that exceeds a predetermined rate limit. The one or more processors are also configured to execute the instructions to measure an amount of the marked traffic by using one or more filters to detect information written in a data packet by the one or more processors. The one or more processors are further configured to execute the instructions to output the measured traffic amount in a period determined based on an expected time duration of an abnormal traffic. The abnormal traffic is a detection target of the network apparatus.