Network Monitoring: What the Endpoint Cannot See

Endpoint protection sees what happens on the machine. Network monitoring sees what happens between machines. Neither substitutes for the other, and a significant share of attacks is visible on only one.

What the network sees that endpoints cannot

Unmanaged devices. Printers, IP cameras, building automation controllers, a supplier's laptop. No agent runs on these, so endpoint protection cannot see them at all.

Command-and-control traffic. An outbound connection to an unknown destination often shows in traffic even when everything on the host is quiet.

Exfiltration. Unusually large outbound volumes are readily measurable at network level.

Lateral movement. Unusual machine-to-machine connections: a workstation suddenly connecting to other workstations' administrative ports.

OT environments. No agent can be installed on industrial devices, so the network is the only source of visibility. We covered this in our ICS/SCADA article.

Where to start without a dedicated tool

You need not buy an NDR product immediately. Much can be extracted from existing infrastructure.

1. NetFlow from network devices. Most managed switches and routers can export flow data: who, whom, when, how much. It carries no content but does carry the connection pattern, which suffices for most detections.

2. Firewall logs. The record of allowed and denied traffic already exists; it is simply not analysed. Patterns in outbound denials are often the first signal.

3. DNS logging. An undervalued source. Command-and-control almost always begins with name resolution, and unusual domains show here first.

4. Proxy logs. Outbound web traffic with volumes. Shadow IT discovery also starts here.

These four sources typically already exist; nobody collects them. Our logging article covers in detail what is worth sending to the SIEM.

What to watch for

• A new connection between two devices that never communicated before
• Unusual timing: systems on a daily rhythm suddenly active at night
• Large outbound volumes to unusual destinations
• Many failed connections in a short window: a sign of reconnaissance
• An unknown device appearing on the network
• Encrypted traffic on unusual ports or to unusual destinations

Where projects stall

Encrypted traffic. Most traffic today is TLS, so content is invisible. Metadata (who, whom, how much, at what cadence) is not, and a significant share of detections rests on it. TLS decryption is an option, but with privacy and performance consequences.

Placement. Most network traffic does not cross the perimeter: east-west, machine-to-machine traffic stays inside. Watching only the perimeter misses lateral movement.

Data volume. Full packet capture is expensive and rarely worthwhile. Flow data plus selective capture (only on suspicious connections) gives a better ratio.

In OT environments

Here network monitoring is not a supplement but the primary instrument. Industrial traffic is remarkably predictable: the same devices talk to the same peers at the same cadence. Anomaly detection therefore works far better than in IT.

The method is passive: traffic mirroring from a SPAN port or network TAP, without sending a single packet.

Our IT security services and OT services both cover establishing network visibility.