Abstract: A wireless node in a wireless network examines data packets directed to itself (i.e., value in destination address field indicates that the wireless node is an intended recipient)for presence of anomalies that suggest intrusion. The data packet is examined as part of the normal course of operation of the node. Upon detection of an anomaly, the wireless node sends a message packet containing details of the anomaly to a sentinel device. The sentinel device processes the anomalies to determine if a possibility of intrusion is indicated, and activates a spy routine in the wireless node. The spy routine enables further investigation into the intrusion. As components (such as wireless nodes) in the wireless network operate normally (normal operations) until an anomalous condition/event occurs, the additional power requirements for intrusion detection are reduced. If intrusion is detected, appropriate actions, such as alerting an operator, are taken to mitigate the intrusion.