North-South vs East-West Traffic

North-South and East-West are two directions in which data moves across a network. The names come from how data center diagrams are usually drawn. North-South traffic enters the environment from outside or leaves it — for example between a user on the Internet and a server in a data center or cloud (top-to-bottom on the diagram). East-West traffic is horizontal: it stays inside and moves between servers, virtual machines, containers, microservices and databases. The distinction matters mainly for network architecture and security. North-South traffic is controlled at the network edge (firewall, IPS, WAF). East-West traffic usually bypasses those controls — which is exactly why it is the main channel an attacker uses to move across the network (lateral movement).

What is North-South traffic?

North-South traffic crosses the boundary of the environment — entering it from outside or leaving it. The name comes from the convention of drawing networks with clients at the top and servers at the bottom, so this traffic runs vertically. The inbound part is sometimes called southbound and the outbound part northbound.

• A user logs into a corporate application over the Internet.
• External API requests reach a server in the data center.
• A server pulls updates or queries an external API.
• A customer completes a payment in an online store.
• VPN connections and remote-worker traffic to internal resources.

What is East-West traffic?

East-West traffic stays inside the environment and runs horizontally between its parts — hence the name, since servers are drawn side by side on a diagram. It covers server-to-server communication, database replication, calls between microservices, cluster-to-cluster traffic and exchanges between hosts in the same data center or cloud.

• Database replication and synchronization between nodes.
• API calls between microservices in a Kubernetes cluster.
• Communication from an application to its backend and storage layer.
• Internal backups and file transfers between systems.
• Route exchange between routers and hypervisor-to-hypervisor communication.

How does North-South traffic differ from East-West?

The key differences concern direction, where policy is enforced, and visibility:

• Direction: North-South crosses the edge of the environment; East-West stays inside it.
• Control point: North-South is filtered by edge firewalls, IDS/IPS, WAFs and gateways; East-West needs internal controls — microsegmentation, host-based firewalls, service mesh policies.
• Volume: in many modern data centers, there is more East-West traffic than North-South.
• Visibility: North-South almost always passes through edge devices where it is logged; East-West often flows host-to-host without crossing any inspection point.
• Trust model: internal traffic is often treated as trusted by default — a mistake that zero trust corrects.

Why is East-West traffic growing?

East-West traffic is growing because of how today’s applications and infrastructure are built:

• Virtualization: many jobs once handled by dedicated hardware moved into virtual machines and software, which multiplies communication between components.
• Microservices: a single user request (one North-South flow) can trigger dozens of internal service-to-service calls (East-West traffic).
• Containers and orchestration: Kubernetes and similar platforms generate heavy pod-to-pod and service-to-service traffic.
• Distributed data: replication, sharding and distributed databases require constant exchange between nodes.

This growth forced a shift in network design. Traditional three-tier topologies (access-aggregation-core) are being replaced by leaf-spine fabrics, where every leaf switch connects to every spine. This shortens the path between any two hosts and gives server-to-server traffic low, predictable latency.

Why does this distinction matter for security?

The classic security model focuses on the network edge. It assumes threats arrive from outside (North-South), so it places firewalls, IPS and WAFs at the boundary. The problem is that once someone breaks through the edge — via phishing, a stolen identity, or a flaw in an externally exposed service — they move on within East-West traffic that edge controls simply cannot see.

This movement across the network (lateral movement) is a typical attack stage: after gaining a foothold on one host, the attacker maps the network, harvests more credentials and heads toward the highest-value targets — domain controllers, databases, backup systems. Most of these connections never leave the network, so they never reach the edge and stay invisible to tools that watch only North-South traffic. This lack of East-West visibility is one of the most common detection gaps.

How is East-West traffic secured?

Since edge controls do not reach inside the network, East-West traffic is secured differently:

• Microsegmentation: divides the environment into small, isolated zones with workload-level policies. It limits how far an attacker can spread after the first breach and reduces the attack surface.
• Zero trust: removes the default trust in internal traffic — every connection must be authenticated and authorized under least-privilege principles.
• Host-based firewalls and service mesh policies: enforce rules close to the workload, often using mutual TLS between services.
• Monitoring and detection: telemetry from inside the network (NetFlow/IPFIX flows, logs, packet capture from SPAN/TAP ports) catches anomalies that segmentation alone will not stop.

What does East-West visibility mean for the SOC and NDR?

For a SOC team, East-West traffic is the hardest to monitor because it does not pass through a natural inspection point. This is where NDR (Network Detection and Response) plays a key role: it analyzes network telemetry — flows and, where possible, packet content — learns what normal communication looks like, and flags deviations from that baseline.

Signs of movement across the network, visible in the East-West layer, include:

• Internal scanning and unusual connection attempts between hosts that normally never communicate.
• Abuse of administrative protocols — SMB, RDP, WinRM, SSH — in atypical source-destination relationships.
• Pass-the-hash, Kerberoasting and other authentication abuse within internal traffic.
• Beaconing to internal pivot nodes and staging of exfiltration inside the network.

Effective monitoring combines both directions: North-South controls catch threats at ingress and egress, while East-West visibility shortens the time to detect an attacker who is already inside. Full coverage of both planes is also typically required by standards and regulations (e.g. ISO/IEC 27001).

Learn more

• Secure Access Service Edge (SASE) — SASE shifts traffic inspection to the edge, affecting both north-south and east-west flows.
• API Security — API calls often create east-west traffic between services and north-south traffic from clients.
• BYOD (Bring Your Own Device) — BYOD devices add user traffic that can enter north-south paths and access internal east-west resources.
• SaaS / IaaS / PaaS — Cloud service models change where traffic enters and moves internally, reshaping north-south and east-west patterns.
• Cloud Access Security Broker (CASB) — CASBs control traffic to cloud apps, mainly covering north-south flows between users and services.
• On-premise / Cloud / Hybrid — Deployment model affects whether traffic stays internal east-west or crosses boundaries as north-south.