Intrusion detection systems monitor computer networks looking for evidence of malicious actions. The attacks detection can be classified into either misuse or anomaly detection. The misuse detection can not detect unknown intrusions whereas the anomaly detection can give false positive. Combining the best feature of misuse and anomaly detection one intelligent intrusion detection system (IIDS) is proposed which is able to detect not only the known intrusions but also the unknown intrusions. For detecting the unknown intrusions the proper knowledge base is to be formed after preprocessing the packets captured from the network. The preprocessing is the combination of partitioning and feature extraction. The partitioning of packets is based on the network services and extraction of attack feature is added to the knowledge base. The preprocessed attacks can be classified by using mining classification which will be given to rule builder. The network intrusion detection system should be adaptable to all type of critical situations arise in network. This is helpful for identification of complex anomalous behaviors. This work is focused on the TCP/IP network protocols and network based IDS.