What is the difference between NDR, network traffic analysis and NetFlow monitoring?
NetFlow monitoring records who talked to whom, network traffic analysis studies those records, and NDRNDR: network detection and response. Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker. adds detection and response on top. NetFlow and similar formats are summaries that routers and switches export for each connection: addresses, ports, start time, bytes and packets. Monitoring tools turn them into bandwidth graphs and top-talker lists, which is useful for capacity and troubleshooting but leaves the security judgement to you. Network traffic analysis (NTA) was the earlier name for tools that looked at traffic for security purposes. NDR (network detection and response) is the current name: it learns what is normal per host, raises alerts on attacker behaviour and supports the response with evidence. Flow summaries alone miss details such as DNS answers or the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake. NetSenX reads its own copy of the traffic from an agent or a mirror port rather than relying only on exported flow records.
Read next
Related questions
Terms used here
- NDR (network detection and response)
- Security monitoring that watches the traffic between devices and raises an alert when one behaves like an attacker.
- TLS (Transport Layer Security)
- The encryption that protects most internet traffic, such as HTTPS.