nmap -D scan, for scanning to return any result, your real IP address must be used amongst the pool of decoys. Without your real IP being used, you will not be able to receive any response from your target server, and nmap scanning would not work.
-D option creates confusion by introducing decoy IP addresses. So, if the target server is logging incoming connections, it will see an assortment of spoofed IP addresses plus your real IP address.
If you are not careful to ensure that the decoys are up (no response after initial SYN on active port that returns SYN-ACK) or if your ISP filter spoofed IP addresses (only your IP will appear on the server log), it would not be difficult to spot the actual IP address doing the scan.
Here are the relevant parts from the man page of
-D decoy1[,decoy2][,ME][,...] (Cloak a scan with decoys) .
Causes a decoy scan to be performed, which makes it appear to the remote host that the host(s) you specify as decoys are scanning the
target network too. Thus their IDS might report 5-10 port scans from
unique IP addresses, but they won't know which IP was scanning them
and which were innocent decoys. While this can be defeated through
router path tracing, response-dropping, and other active mechanisms,
it is generally an effective technique for hiding your IP address....
Note that the hosts you use as decoys should be up or you might accidentally SYN flood your targets. Also it will be pretty easy to
determine which host is scanning if only one is actually up on the
Decoys are used both in the initial ping scan (using ICMP, SYN, ACK, or whatever) and during the actual port scanning phase. Decoys
are also used during remote OS detection (-O). Decoys do not work with
version detection or TCP connect scan....
... Also, some ISPs will
filter out your spoofed packets, but many do not restrict spoofed IP
packets at all.