There is something so satisfying in kicking off an entire RFC1918 scan.
Doing a single port at a brisk but safe (for my environment) pace.
~/# nmap -Pn -n -p <single port number> -T4 --open 10.0.0.0/8
~/# nmap -Pn -n -p <single port number> -T4 --open 172.16.0.0/12
~/# nmap -Pn -n -p <single port number> -T4 --open 192.168.0.0/16
(command broken out for dramatic effect - also note that I break out each of those CIDRs into /24's so that if anything breaks, I can pick up easier where the last known good ended. It's scripted and I prefer it this way.)
I am not doing a ping sweep or a DNS resolution. I'm assuming all hosts are up. And I'm looking for every host with a single port open. So even if they dont respond to pings (or something is preventing pings), I should get an answer back.
Note, I could certainly do faster (T5 or masscan, gawd) - but this is about as fast as I'm going to do in my environment and still be safe.
Also, only looking for open ports right now - no fingerprinting yet.
A cool thing about this approach is many intrusion detection still will only look for multiple ports on a single host to trigger an alert. Some still ignore many hosts / single port scans (to their detriment).
We've long sense purple teamed this, so I sent a notification to SOC letting them know my actions and asking them nicely (I bribed them last week) to not stop me, lol.
Should take a couple weeks to a month at this pace and in my environment to hit every single one of the just shy of 18,000,000 hosts