This paper focuses on the security aspect of RPL (Routing Protocol for Low-power and lossy network) by introducing a new type of threat - the topology attack, which changes the node operation for breaking the optimised network topology, and designing a specification-based IDS for detecting it. We present two novel RPL attacks of this type: the rank attack and local repair attack. We also propose an IDS architecture using network monitor backbone, and describe its monitoring mechanisms through a RPL finite state machine implemented in each monitor node. We show that our system can effectively detect these routing operation threats with a reasonable overhead.