If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

Spoof Scan uses a forged source IP address, so the IDS may log the scan but cannot attribute it to the real attacker, allowing the technique to still be used without exposing the scanner.

TCP Connect scan completes the full three-way handshake and is detectable, but is not the answer the question targets - the focus is on which technique the IDS specifically breaks through half-open connection detection.

TCP SYN scanning sends SYN packets to target ports but never completes the three-way handshake, creating a flood of half-open connections that modern IDS systems are specifically tuned to detect via signatures matching this anomalous pattern. Because the IDS can identify and alert on these incomplete connection attempts in real time, the technique is rendered ineffective in an environment with active intranet IDS monitoring. Stealth techniques like Idle Scan or Spoof Scan are designed precisely to circumvent this kind of detection.

Idle Scan uses a third-party 'zombie' host to relay probes, meaning no packets from the actual attacker ever reach the target or the IDS, making it one of the stealthiest methods available.