If there is an Intrusion Detection System (IDS) in intranet, which port scanning technique cannot be used?

Spoof Scan uses a forged source IP address so the IDS cannot attribute or trace the scan back to the attacker's real machine, greatly reducing the effectiveness of detection.

TCP Connect scan completes the full three-way handshake and is also detectable, but it does not generate the distinctive half-open connection signature that IDS TCP scan rules primarily target.

TCP SYN scan sends SYN packets and waits for SYN-ACK responses without completing the three-way handshake, creating a flood of half-open connections that IDS engines match against well-known signatures. Unlike evasion-focused techniques, TCP SYN provides no mechanism to obscure this distinctive traffic pattern from a passive or inline IDS monitoring the intranet.

Idle Scan routes probes through a third-party zombie host so the attacker's IP address never appears in the monitored traffic, making the real source invisible to the IDS.