# What is the difference between NDR and a firewall?

A firewall decides which connections are allowed; NDR watches what happens inside the connections that were allowed. A firewall sits at the edge of the network, or between segments, and enforces rules: this address may reach that server on this port, everything else is refused. It is essential, but an attacker who gets in through a phishing e-mail or a stolen password uses connections the firewall permits, and most firewalls do not watch traffic between devices on the same segment at all. NDR (network detection and response) gets a copy of the traffic and looks for behaviour: a workstation that suddenly talks to many servers, a host calling an outside address every few minutes, data leaving at night. You need both. NetSenX does not filter or block anything; it alerts and explains, and you or your firewall act on the alert.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-a-firewall

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What is the difference between NDR, network traffic analysis and NetFlow monitoring?](https://netsenx.com/en/faq/ndr-vs-network-traffic-analysis-vs-netflow-monitoring)
- [Is AI-based detection better than signatures?](https://netsenx.com/en/faq/is-ai-based-detection-better-than-signatures)
- [Agent-based or SPAN/TAP-based network monitoring: which is better?](https://netsenx.com/en/faq/agent-based-or-span-tap-based-network-monitoring)
- [Does NDR work on encrypted traffic?](https://netsenx.com/en/faq/does-ndr-work-on-encrypted-traffic)
- [Can NDR see cloud and SaaS traffic?](https://netsenx.com/en/faq/can-ndr-see-cloud-and-saas-traffic)