Which NMAP feature can a tester implement or adjust while scanning for open ports to avoid detection by the network's IDS?

Nmap provides timing templates ranging from -T0 (paranoid, slowest) to -T5 (insane, fastest), as well as fine-grained controls such as --scan-delay and --max-rate, which throttle how quickly probes are sent. IDS systems commonly detect port scans by identifying abnormally high rates of connection attempts in a short time window; slowing the scan spreads those attempts over a longer period, reducing the signal that triggers IDS alerts. This makes timing adjustment the primary Nmap mechanism for avoiding automated detection.

OS fingerprinting (the -O flag) analyzes responses to identify the operating system running on a host, but it does not reduce the scan's visibility or rate and therefore does not help evade IDS detection.

An ICMP ping sweep (-sn) is used to discover which hosts are active on a network and does not adjust scan speed or packet rate to avoid detection.

Traceroute functionality maps the network path packets take to a destination but does not alter the speed or pattern of a port scan in a way that would evade IDS detection.