While scanning with Nmap, Patin found several hosts which have the IP ID of incremental kiosk.adobe.com is the host with incremental IP ID sequence. What is the purpose of using "-sl" with Nmap?

Stealth scanning in Nmap refers to the SYN scan (-sS), which sends half-open TCP connections, and is a distinct technique from the IDLE scan invoked by -sI.

ICMP-based host discovery in Nmap uses -sn or -PE flags, not -sI, which is exclusively reserved for the IDLE/zombie scan method.

The -sI option in Nmap initiates an IDLE scan (also called a zombie scan), which works by sending spoofed packets through a third-party zombie host that has a predictable incremental IP ID sequence - such as kiosk.adobe.com in this scenario. By monitoring changes in the zombie's IP ID counter, the attacker can infer whether ports on the real target are open or closed without ever directly contacting the target, making attribution extremely difficult.

'Silent scan' is not a recognized Nmap scan category; the -sI flag is specifically documented as the IDLE scan option in Nmap's official reference.