This paper describes the first specification based approach applying on intrusiondetection in mobile ad hoc networks. In particular, we employ specification-based techniques to monitor the ad hoc on-demand distancevector (AODV) routingprotocol, a widely adopted ad hoc routingprotocol.A mobile ad hoc Network (MANET) is a mobile mesh network in which mobile wireless nodes are both hosts and routers so they can communicate without base stations. Because of this cooperative routing capability, MANETs have envisioned for military and emergency communication, but become more vulnerable to routingattacks than wired networks. If a malicious node propagates forged routing information in a MANET, the node can easily paralyze the network or hijack valuable routes. Due to MANET’s particular routing characteristics, defending routingattacks is challenging and critical in MANET. Traditional cryptographic authentication schemes are not sufficient due to insider routingattacks. Intrusiondetection systems are ideal for insider attacks, but most of them are designed for wired networks and thus they can neither directly deploy in MANETs nor effectively detect new routingattacks in MANET. So we apply specification based intrusiondetection approach that defines normal behavior of the protected networks to detect new routingattacks in MANETs. Therefore, we proposed a complete distributed intrusiondetection system that consists of four models for MANETs with formal reasoning and simulation experiments for evaluation.