> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/appliances/network-sensor/overview.md).

# Overview

## Overview

The ThreatDefence Network Detection and Response (NDR) Sensor is available in two deployment options:

* [Physical Sensor](/appliances/network-sensor/physical-sensor.md): High-performance hardware appliances designed for large enterprise or data-center environments.
* [Virtual Sensor](/appliances/network-sensor/virtual-sensor.md): Software-based appliances suitable for smaller deployments and cloud-only environments.

Both types provide passive monitoring of network traffic to deliver visibility, intrusion detection, and behavioral analytics for the ThreatDefence SecOps platform.

***

## Deployment

The NDR Sensor is a **passive device** that monitors a copy of production traffic.\
The recommended deployment location is where **North-South traffic** (internal ↔ external) passes through your environment, typically on the internal firewall interface.

To achieve this, configure a **SPAN (port mirroring)** session on your switch or firewall to forward traffic to the NDR sensor.

***

## Deployment Diagram

![Network Sensor Deployment](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-a3b0f36e8f5cb7b1438b98acacfc562cb8e7d8ff%2Fnetwork_diagram.png?alt=media)\
\&#xNAN;*Example span port configuration feeding mirrored traffic to a ThreatDefence sensor.*

***

## Example: Cisco Switch Port Mirroring

For a typical Cisco switch where the internal firewall is connected on port `eth0/1` and the ThreatDefence sensor is connected on port `eth0/2`, the configuration would be:

```
monitor session 1 source interface eth0/1
monitor session 1 destination interface eth0/2
```

This configuration:

* Creates monitoring session **1**.
* Forwards traffic from the **source** interface (firewall port).
* Mirrors traffic to the **destination** interface (sensor port).

> **Note:** Interface notation (e.g., `eth0/1`) may vary depending on the switch model and configuration.

***

## Outbound Connectivity Requirements

For the NDR Sensor to operate correctly, outbound HTTPS access is required for updates and threat intelligence feeds.

* **Protocol / Port**: TCP/443 (HTTPS)
* **Purpose**: OS updates, ThreatDefence Threat Intelligence feeds
* **Proxy Support**: Ensure proxy settings are configured to allow SSL/TLS inspection if required.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/appliances/network-sensor/overview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.