An intrusion detection systems (IDS) main purpose is to monitor a resource and notify someone in the event of a specific occurrence for an appropriate response. Based on the sources of audit data, as IDS can be classified into host-based intrusion detection system (HBIDS) or a network-based intrusion detection system (NBIDS). In this paper we focus on NBIDS and propose a novel concept in IDSs called the nethost-sensor. We describe the nethost-sensor ability to thwart end-to-end encryption, denial of services (DoS) attacks, and reduces false positives. This paper presents our experimental procedures and results in designing the nethost-sensor.