# What is the difference between NDR and an IDS or IPS?

An IDS or IPS matches traffic against known attack patterns; NDR looks at how each device behaves over time. An IDS (intrusion detection system) raises an alert when traffic matches a signature, such as a known exploit or malware pattern. An IPS (intrusion prevention system) does the same and can drop the matching traffic, usually as part of a firewall. Both are good at known threats and weaker when an attacker uses legitimate tools or a new variant with no signature. NDR (network detection and response) learns what is normal for each host and flags deviations: new peers, regular call-outs, scanning, unusual volumes. Many companies run both. NetSenX is an NDR: it scores host behaviour, explains each alert in plain language, and does not drop or block traffic, so it can run beside your firewall's IPS without changing your network path.

FAQ: [NDR, EDR, SIEM, XDR, MDR](https://netsenx.com/en/faq/tools) · https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-an-ids-or-ips

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/blog/2026-09-24_ndr-vs-edr-vs-siem

## Related questions

- [What is the difference between NDR and a firewall?](https://netsenx.com/en/faq/what-is-the-difference-between-ndr-and-a-firewall)
- [What is the difference between NDR, network traffic analysis and NetFlow monitoring?](https://netsenx.com/en/faq/ndr-vs-network-traffic-analysis-vs-netflow-monitoring)
- [Is AI-based detection better than signatures?](https://netsenx.com/en/faq/is-ai-based-detection-better-than-signatures)
- [Agent-based or SPAN/TAP-based network monitoring: which is better?](https://netsenx.com/en/faq/agent-based-or-span-tap-based-network-monitoring)
- [Does NDR work on encrypted traffic?](https://netsenx.com/en/faq/does-ndr-work-on-encrypted-traffic)