Firewalls work only at the point of entry to the network, and they work only with packets as they pass in and out of the network. Once an attacker has breached the firewall, he can roam at will through the network. That's where intrusion detection is important. There are a number of approaches that can be used for detecting intruders.
Many experts advise using a combination of methods rather than relying on any single mechanism.
Perhaps the most famous IDS is Tripwire, a program written in 1992 by Eugene Spafford and Gene Kim. Installed on a host, it checks to see what has changed on the system, verifying that key files haven't been modified. The agent is initially installed against a pristine host installation and records important system file attributes, including hashes of the files. The agent software then periodically compares the current state of those files to the stored attributes and reports any suspicious changes. Another host-based approach monitors all packets as they enter and exit the host, essentially taking a personal firewall approach.