# What is the difference between the basic macOS mode and packet capture?

The basic mode sees connections, timing and volumes; packet capture also reads the unencrypted fields of the TLS handshake, which some features need. On macOS, the agent runs in a basic mode that observes the connections of the Mac it is installed on. That is enough for the core detections, such as beaconing, scanning, lateral movement and unusual outbound volume. Packet capture means the agent copies the packets themselves to read a few protocol fields, still without decrypting anything. It is available where the agent runs on Linux, or as a sensor on a SPAN or TAP port. Two features depend on it: TLS fingerprinting, from the Starter plan, which recognises known malware clients by their handshake, and the NQCI crypto inventory, active from the Pro plan, which reports quantum-vulnerable and hybrid key exchange. If you need either, plan a Linux agent or a mirror-port sensor.

FAQ: [NetSenX: plans and set-up](https://netsenx.com/en/faq/product) · https://netsenx.com/en/faq/what-is-the-difference-between-the-basic-macos-mode-and-packet-capture

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features

## Related questions

- [How do I turn on the NetSenX crypto inventory (NQCI)?](https://netsenx.com/en/faq/how-do-i-turn-on-the-netsenx-crypto-inventory)
- [Does NetSenX alert from the first day after installation?](https://netsenx.com/en/faq/does-netsenx-alert-from-the-first-day)
- [What is the network map in NetSenX?](https://netsenx.com/en/faq/what-is-the-netsenx-network-map)
- [How are NetSenX alerts delivered?](https://netsenx.com/en/faq/how-are-netsenx-alerts-delivered)
- [How long does NetSenX keep alert history?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-alert-history)