If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

Spoof scans use forged source IP addresses to obscure the real attacker identity, making attribution by the IDS extremely difficult and allowing the scan to proceed without revealing the true source.

A TCP SYN scan sends SYN packets but never completes the three-way handshake, leaving a pattern of half-open connections that IDS signatures explicitly watch for; a well-configured intranet IDS will immediately detect and alert on this activity, rendering the technique impractical for covert reconnaissance.

TCP Connect scans complete the full three-way handshake and are detectable by IDS, but they are not specifically identified as 'cannot be used' - they can still be attempted despite the higher detection risk.

Idle (zombie) scans route probes through an innocent intermediary host, hiding the attacker's real IP from both the target and the IDS, making them a preferred evasion technique in monitored environments.