I'm reading the Nmap Security Scanning book and it mentions that servers often have Intrusion Detection Systems installed. From my understanding, these systems alert server admins when there is suspicious activity.

I'm interested in installing an IDS for my personal computer, a Macbook. I'm not too concerned with any security threats. I just want to see what this type of software does.

How useful is having an IDS on a personal computer? Are there better options available?

  • 1
    This is likely off-topic (we don't like to do product recommendations here) - but OSSEC is one of the standard open-source Host Intrusion Detection Systems (HIDS). If fully configured, mind, it'll make using your laptop unpleasant (HIDS systems are designed to monitor and possibly prevent unauthorized processes and file changes, after all). I recommend rather than doing it on your laptop, get a Amazon tiny instance (or Azure or Google or whatever) and try it out there.
    – crovers
    Oct 4, 2016 at 15:11
  • 2
    I agree that this question is borderline off topic. Could you perhaps edit and remove the request for product recommendations?
    – Anders
    Oct 4, 2016 at 15:20
  • I have OSSEC agent on my macbook, which reports to an OSSEC server. It generates a lot of useless sh*t. It's more useful on something without a GUI (there's less logging) and generally more static like a server Oct 4, 2016 at 22:11

3 Answers 3


What you are really looking for is heuristic behaviour scanning.

An IDS is looking for non-standard behaviour of network traffic flows or standard behaviour of known intrusions.

You can indeed get some smart anti-malware clients that do heuristics on the client. Look for client software offering zero-day protection.

Of course, enterprise IDS systems operate on a very different scale and are looking for larger patterns. Still, they will attempt to spot things like malware phoning home to command and control systems and probing network attacks.


I don't think a server-intended HIDS system (like OSSEC) is a good option for a laptop or other general purpose computer. Servers in today's age are very specialized and regimented and a HIDS depends on this. It knows where files should and should not be created or modified, what processes should and shouldn't be running. Essentially, there is a white list of allowable things that happen on the computer and anything outside that list is an alert.

The term for personal computer protection is 'endpoint protection' and includes things like traditional anti-virus. They use blacklisting, primarily - known signatures, known bad behaviours. It is a much harder problem on an endpoint, since users want to run arbitrary programs and do arbitrary things - how do you tell the difference between an installer the user wants to run and one that is accidentally run from an attachment in email? Between a compiler and a self-modifying virus? Lots of issues there.

Running HIDS on a personal computer is just going to be annoying - give it a try on one of the many low-cost/cheap linux hosts out there.


Nmap doesn't have its intrusion detection system rather there are several features rigged in Nmap to bypass the IDS such as fragmentation, decoys etc. For more information You can look here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .