Welcome to Tenable Network Monitor

Last Updated: July 24, 2026

This user guide describes the Tenable Network Monitor® (formerly known as NNM) 6.5.x (Patent 7,761,918 B2) architecture, installation, operation, and integration with Tenable Security Center and Tenable One Vulnerability Management, and export of data to third parties. For assistance, contact Tenable Support.

Passive vulnerability scanning is the process of monitoring network traffic at the packet layer to determine topology, clients, applications, and related security issues. Tenable Network Monitor also profiles traffic and detects compromised systems.

Tenable Network Monitor can:

• Highlight all interactive and encrypted network sessions.

• Detect when new hosts are added to a network.

• Track which systems are communicating on which ports.

• Detect which ports are served and which are browsed by each system.

• Detect the number of hops to each monitored host.

Passive Scanning vs. Active Scanning

Active scanning generates network traffic by establishing connections to hosts. Tenable Network Monitor instead listens passively to packets on the wire, which avoids disruption to critical assets in your network. Tenable Network Monitor must be connected to a SPAN port or network tap that provides a bi-directional view of traffic between machines.

Tenable Network Monitor derives information from the network protocols that machines use as they communicate. As a result, attributes such as operating system, MAC address, and NetBIOS name may take time to appear — or may not be discoverable at all — depending on the traffic present in your environment.

Do not expect passive scan results to match those from an active scanner. Some attributes, such as BIOS UUID, are only available when a scanner actively logs in to a host — as Tenable Nessus and Tenable Agentsdo. Tenable Network Monitor, Tenable Nessus, and Tenable Agents cover complementary aspects of your environment and are most effective when used together.