the present invention relates to a method for detecting network anomaly in network architectures based on locator / identifier split , the detection flow is as follows : initialization processing , and in itr : processing data packets , sending a map - request , determining whether to send an additional map - request , sending the data packet , processing the map_reply , processing eid - to - rloc cache entry expired ; in etr : processing data packet , processing map - request , determining whether the traffic of the itr currently sending the map - request is abnormal , replying to the itr of which the query traffic is abnormal , replying to itr of which the query traffic is abnormal . with respect to the characteristic that the network architecture based on locator / identifier split needs to query the relationship between the locator and the identifier for packet delivery , the present invention detects network anomaly based on query traffic instead of network data packet traffic . thus the present invention has the advantages of effectively reducing the investment on detection device , the overhead of exchanging monitoring information and the detection system maintenance cost ; facilitating cross domain coordination ; and efficiently handling the failures occurring during network operation in time ; effectively improve the reliability of the network , being suitable for a large - scale network .