What Is NDR? How Network Detection and Response Analyzes Traffic

One Network Flow Tells a Story

Imagine a workstation that contacts an unfamiliar internal server, then transfers a large amount of data to an external destination. Each connection may appear ordinary by itself. When source, destination, time, volume, protocol, and session continuity are assembled, the path can reveal behavior that deserves investigation.

Network detection and response, or NDR, continuously analyzes network traffic and telemetry to detect suspicious communications, investigate related assets and sessions, and support response. Its focus is the context of how traffic moves through an organization, not a single packet in isolation.

The Role of NDR

NDR uses packets, flow records, and connection metadata from network observation points to model normal communication patterns. It then evaluates changes in frequency, direction, volume, and destination to create evidence-rich alerts. Cisco describes NDR as continuously monitoring raw enterprise traffic, establishing a baseline of normal behavior, and alerting on suspicious deviations.

The unit of observation is network communication: which asset connected to which destination, when the session occurred, and how activity moved between segments. Accurate asset ownership, addressing, and time synchronization make this evidence much easier to interpret.

Packets, Flows, and Metadata

Packets can provide detailed communication data. Flow records summarize source, destination, ports, protocol, time, and volume. Metadata such as DNS requests, TLS characteristics, and session attributes adds context. The exact fields and retention period depend on product design, policy, and network architecture.

Collection may use exported flow records from routers and switches or selected traffic delivered through physical or virtual mirroring. Google Cloud documents NDR services working with VPC Packet Mirroring and describes NDR as supporting detection, investigation, forensics, root-cause analysis, and response.

The key design question is where traffic is visible. Perimeter-only collection can miss traffic between internal segments. A limited internal sensor may miss branch, remote-user, or cloud paths. Coverage should therefore be mapped to actual traffic routes rather than measured only by appliance count.

North-South and East-West Traffic

North-south traffic crosses the enterprise boundary, including internet access, inbound requests to public services, and outbound transfers. East-west traffic moves between internal assets and segments, such as a workstation contacting a file server or one cloud workload calling another.

Cisco explains that network traffic analysis monitors both communications crossing the perimeter and traffic moving laterally inside the network. This distinction matters because an attacker can pass the boundary and then move between internal systems. A sequence of internal sessions can change the priority of an otherwise ordinary external connection.

Baselines and Anomaly Detection

A baseline is not one average for the entire enterprise. It models repeated relationships such as asset role, destination, time, frequency, direction, and volume. A large transfer from a backup server and the same transfer from an employee workstation can carry different meaning.

Behavioral modeling, rules, threat intelligence, and machine learning may be combined. Cisco and Google Cloud both describe non-signature methods as a common NDR characteristic. The exact detection logic varies by product, so a vendor-specific score or alert name should not be treated as a universal NDR rule.

An anomaly is a reason to investigate, not proof of compromise. A new service, scheduled backup, software deployment, or recovery operation may change traffic patterns. Analysts should review asset role, authorized changes, identity context, and related sessions before deciding whether to tune the baseline or expand the investigation.

From Alert to Investigation

Start by resolving source and destination addresses to real assets at the event time. Account for dynamic addressing, network address translation, proxies, and short-lived cloud resources. Then order first and last observation times, session count, volume, ports, and protocols into a timeline.

Search for the same destination across other assets, other targets contacted by the same source, and related DNS or external sessions. Cisco notes that NDR can attribute behavior to an IP address and support forensic analysis of lateral movement. Address assignment and authentication records should be cross-checked before attributing activity to a user or workload.

Response Connections

Some NDR products can enforce a response directly; others send a block request to a network control or an operational workflow. Response options depend on deployment and integration. Teams should verify the real control path, approval authority, business impact, expiration, and release conditions before relying on an interface button.

After a control is applied, confirm that the suspicious session stopped and did not move to another path. Preserve the alert evidence, approver, control applied, service impact, validation result, and release time. A closed alert alone does not demonstrate successful containment.

Operational Checks

• Map collection points to perimeter, data-center, internal-segment, branch, remote-access, and cloud traffic paths.
• Review visibility for encrypted communications, virtual networks, regions, projects, and accounts whenever architecture changes.
• Preserve source, destination, asset role, session time, volume, DNS, authentication, and change context for each investigated alert.
• Test the request, approval, application, validation, and release path with an authorized limited rule rather than production disruption.

Scope and Limits

NDR analyzes traffic that reaches its observation points. Activity that stays inside one host or follows an unmonitored path will not have the same network evidence. Dynamic addresses, proxies, NAT, and ephemeral cloud assets make synchronized asset and identity context particularly important.

Baselines also change with operations. New services, reorganizations, remote-work shifts, and backup-policy changes can alter normal traffic. Automated learning does not replace review of asset changes, collection gaps, alert trends, and response outcomes.

Summary

NDR analyzes packets, flows, and metadata to model normal network behavior, detect suspicious deviations, investigate affected assets and sessions, and connect evidence to response. Its value depends on deliberate north-south and east-west collection, accurate asset context, traceable alert evidence, and validation after containment.