Host-based intrusion detection systems typically monitor system log files and other audit trails and respond to unusual activity. For example, an IDS may notice when a user logs in from an unusual host or at an unusual time, or when a user’s shell history file is truncated (an act typical of an attacker covering his trail). The IDS may respond by alerting the system administrator, or may take more aggressive action such as disabling the user’s account.

Some host-based IDS systems can monitor log files collected from multiple hosts (either through syslog’s remote-logging capability or through a client/server architecture built into the IDS). Such multihost IDS systems are convenient for administrators who are responsible for large networks of hosts.

Network-based intrustion detection systems (NIDSs) monitor network packets rather than (or in addition to) system logs, and look for unusual network activity, such as scans to unused TCP ports or packets that resemble known network-based attacks, such as attempts to access the phf CGI script in a request to the system’s HTTP port. A simple NIDS might only attempt to detect network-based attacks or port scans directed at its own host; such a system might not only alert the system administrator, but automatically defend itself by adding the attacker’s source IP to a packet-filtering firewall system. More sophisticated NIDS setups monitor packets directed at any host on their local network, and alert the network administrator. (If the NIDS is running on the network’s firewall, it could also attempt to defend the entire network by blocking packets from the apparent attack host.) An NIDS might also record suspicious packets as evidence for later investigation.