nice script. came up with this some moons ago:
seq \
--equal-width 1 65535 | \
xargs \
--max-procs 16 \
--max-args 1 \
--replace=_$ \
nc \
--verbose \
-z \
--wait 1 \
${TARGET_HOST} _$ 2>&1 | \
grep --ignore-case --only-matching --regexp "connected.*"
Served me needs on local subnets
