# Can we monitor a machine without installing any software on it?

Yes. Anything the machine does on the network can be watched from outside, from a copy of its traffic taken at a SPAN port or a TAP. That is the usual approach for controllers, HMIs, test benches, medical devices and any system whose supplier forbids changes or ties the warranty to them. What you see is its behaviour: which hosts it talks to, at what times, how much data and, in the decoded industrial protocols, what it asks the controllers to do. What you do not see is what happens inside it: files, processes and local logins stay hidden, and so does traffic on links that are not mirrored. NetSenX works this way: one agent on a mirror port watches the whole segment and counts as one device. Beaconing, scanning, lateral movement and unusual outbound volume are flagged on every plan; the OT protocols and OT alerts come with the Pro plan.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/can-we-monitor-a-machine-without-installing-software-on-it

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Should the OT network be separated from the office network?](https://netsenx.com/en/faq/should-ot-be-separated-from-the-it-network)
- [What is the Purdue model, and why does cross-level traffic matter?](https://netsenx.com/en/faq/what-is-the-purdue-model)
- [How do I check that our office network cannot reach production controllers?](https://netsenx.com/en/faq/how-to-check-the-office-network-cannot-reach-production-controllers)
- [Can a ransomware attack on office IT stop a production line?](https://netsenx.com/en/faq/can-ransomware-on-office-it-stop-a-production-line)
- [How do we control maintenance laptops that connect to our production network?](https://netsenx.com/en/faq/how-to-control-maintenance-laptops-on-the-production-network)