# Agent-based or SPAN/TAP-based network monitoring: which is better?

A mirror port or tap is usually better for a whole office segment, and agents are better for specific servers or places where you cannot mirror traffic. With SPAN (a switch setting that copies traffic to one port) or a TAP (a small device that copies traffic on a cable), one sensor sees every device on the segment, including printers, cameras and machines, without installing anything on them. It needs a managed switch or a tap, and it only sees the segments you mirror. An agent on a host sees that host's own traffic wherever it is, including servers in a data centre or cloud where you cannot mirror anything. Many companies combine the two. NetSenX supports both: an agent on a SPAN or TAP port counts as one device for the whole segment, and agents run on Linux and macOS. TLS fingerprinting needs packet capture, which the basic macOS mode does not do.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/agent-based-or-span-tap-based-network-monitoring

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Does NDR work on encrypted traffic?](https://netsenx.com/en/faq/does-ndr-work-on-encrypted-traffic)
- [Can NDR see cloud and SaaS traffic?](https://netsenx.com/en/faq/can-ndr-see-cloud-and-saas-traffic)
- [Can NDR block attacks or only alert?](https://netsenx.com/en/faq/can-ndr-block-attacks-or-only-alert)
- [How do I build an asset inventory from network traffic?](https://netsenx.com/en/faq/how-to-build-an-asset-inventory-from-network-traffic)
- [Does a network map show devices that never send any traffic?](https://netsenx.com/en/faq/does-a-network-map-show-devices-that-never-send-traffic)