# Where should a sensor sit to see what VPN users do?

Behind the VPN gateway, on the internal side, where the tunnel has ended and remote users' traffic is ordinary internal traffic again. A sensor in front of the gateway, on the internet side, sees only encrypted tunnels and learns little from them. In practice, mirror the switch port that connects the VPN gateway or firewall to the internal network, or the link between it and the server segment, to a SPAN or TAP port. Give VPN users addresses from their own pool, so that their traffic is easy to recognise. With NetSenX, one agent on that SPAN or TAP port counts as one device and watches every VPN session that passes it: scanning, lateral movement, beaconing and unusual outbound volume are flagged on every plan, and the VPN view lists the tunnels and gateway sessions it sees. Traffic that a split-tunnelled laptop sends straight to the internet never reaches that sensor.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/where-should-a-sensor-sit-to-see-vpn-users-traffic

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [How do I detect a VPN account used from two countries at the same time?](https://netsenx.com/en/faq/how-to-detect-a-vpn-account-used-from-two-countries)
- [What is impossible travel, and which tool detects it?](https://netsenx.com/en/faq/what-is-impossible-travel-and-which-tool-detects-it)
- [Can network monitoring see where our VPN users connect from?](https://netsenx.com/en/faq/can-network-monitoring-see-where-vpn-users-connect-from)
- [Can NetSenX monitor a laptop that is outside the office?](https://netsenx.com/en/faq/can-netsenx-monitor-a-laptop-outside-the-office)
- [Do home-office laptops need the NetSenX agent installed?](https://netsenx.com/en/faq/do-home-office-laptops-need-the-netsenx-agent)