An overlay network is a virtual network built on top of an existing network, such as the public Internet. It connects devices through logical links and can provide its own routing, addressing, or encryption. A mesh overlay, for example, may route traffic between peers rather than through a single central server.
Overlays have legitimate uses, but they can complicate security monitoring when defenders do not know the software is installed. Malware may use an encrypted overlay to communicate with command-and-control infrastructure, making ordinary destination-based monitoring less informative. Defenders can reduce blind spots by tracking installed network software, monitoring unexpected processes and persistent connections, and applying appropriate IPv4 and IPv6 controls. An overlay is not inherently malicious; its presence and use should be assessed in context.