# What does a network sensor actually collect: content or metadata?

It depends on the product, and you should ask. Some sensors record full traffic for later analysis; others keep only connection records. NetSenX analyses connection metadata and a few protocol fields: timing, volume, source and destination, ports, DNS answers and, where the agent captures packets, the unencrypted parts of the TLS handshake. It never decrypts traffic, so the content of encrypted sessions, such as e-mails, files or what someone typed into a website, stays unreadable. That is enough to see behaviour like beaconing, scanning, lateral movement and unusual uploads, and it limits how much personal data the tool handles. Network metadata can still relate to people, so check it with your data protection officer and read the vendor's data processing agreement.

FAQ: [Small business monitoring](https://netsenx.com/en/faq/smb) · https://netsenx.com/en/faq/what-does-a-network-sensor-actually-collect

## Read next

- https://netsenx.com/en/ndr-for-small-business
- https://netsenx.com/en/pricing

## Related questions

- [Can we start by monitoring only our most critical systems?](https://netsenx.com/en/faq/can-we-start-by-monitoring-only-our-most-critical-systems)
- [What does baselining mean, and how long does it take?](https://netsenx.com/en/faq/what-does-baselining-mean-and-how-long-does-it-take)
- [What should a small company do when a security alert arrives?](https://netsenx.com/en/faq/what-should-a-small-company-do-when-a-security-alert-arrives)
- [Who watches the security alerts at night and at weekends?](https://netsenx.com/en/faq/who-watches-security-alerts-at-night-and-at-weekends)
- [Who watches our network when the IT administrator is on holiday?](https://netsenx.com/en/faq/who-watches-the-network-when-the-it-administrator-is-on-holiday)