If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

Spoof scan uses decoy IP addresses to disguise the true source of the scan, making it difficult for an IDS to attribute activity to the real attacker and allowing it to be used even when an IDS is present.

TCP SYN scan (half-open scan) sends SYN packets but intentionally never completes the three-way handshake, generating an anomalous traffic pattern that is a primary detection signature for IDS engines. Because the intranet IDS monitors for exactly this SYN-only traffic behavior, this technique cannot be used without triggering immediate alerts and attribution back to the scanner.

TCP Connect scan completes the full three-way handshake and is logged at the OS level, but it does not trigger the same half-open connection IDS signatures as TCP SYN, so it can still be executed in an IDS environment.

Idle scan uses a third-party zombie host to relay probe packets so the IDS sees traffic originating from the zombie rather than the real attacker, making it one of the stealthiest techniques and still usable when an IDS is present.