# What is the difference between NDR, network traffic analysis and NetFlow monitoring?

NetFlow monitoring records who talked to whom, network traffic analysis studies those records, and NDR adds detection and response on top. NetFlow and similar formats are summaries that routers and switches export for each connection: addresses, ports, start time, bytes and packets. Monitoring tools turn them into bandwidth graphs and top-talker lists, which is useful for capacity and troubleshooting but leaves the security judgement to you. Network traffic analysis (NTA) was the earlier name for tools that looked at traffic for security purposes. NDR (network detection and response) is the current name: it learns what is normal per host, raises alerts on attacker behaviour and supports the response with evidence. Flow summaries alone miss details such as DNS answers or the TLS handshake. NetSenX reads its own copy of the traffic from an agent or a mirror port rather than relying only on exported flow records.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/ndr-vs-network-traffic-analysis-vs-netflow-monitoring

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [Is AI-based detection better than signatures?](https://netsenx.com/en/faq/is-ai-based-detection-better-than-signatures)
- [Agent-based or SPAN/TAP-based network monitoring: which is better?](https://netsenx.com/en/faq/agent-based-or-span-tap-based-network-monitoring)
- [Does NDR work on encrypted traffic?](https://netsenx.com/en/faq/does-ndr-work-on-encrypted-traffic)
- [Can NDR see cloud and SaaS traffic?](https://netsenx.com/en/faq/can-ndr-see-cloud-and-saas-traffic)
- [Can NDR block attacks or only alert?](https://netsenx.com/en/faq/can-ndr-block-attacks-or-only-alert)