If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

Spoof Scan falsifies the source IP address to mislead attribution, allowing it to remain viable as an evasion technique even on networks monitored by an IDS.

TCP Connect scan completes the full three-way handshake and, while highly detectable, presents as a normal connection rather than the distinct half-open signature that IDS systems specifically flag for SYN scans.

TCP SYN scanning sends SYN packets and records SYN-ACK responses without completing the three-way handshake, producing large numbers of half-open connections that are a well-known IDS detection signature. Modern IDS systems are explicitly configured to alert on this pattern, making the technique unusable without immediate detection in a monitored environment. Techniques such as Idle Scan route traffic through a zombie host, masking the attacker's origin from IDS inspection entirely.

Idle Scan routes probe packets through a zombie host so the IDS observes traffic originating from the zombie rather than the attacker, making it one of the strongest IDS-evasion scanning methods available.