I'm trying to determine if it's possible to specify probe types for nmap to use. For example, I want to scan a subnet (say 192.168.0.0/24) and probe every port on every host to see if a web server is running on that port - the goal being to find a service running on unusual ports.
I understand that by default nmap checks the most common probe/port combinations. I also understand that the -sV --version-all option will attempt all probes on all specified ports. However, this is very time consuming, and if I only care about finding webservers running on unusual ports, I don't need to use all available probes. There's got to be a faster way.
Also, I'm relatively new to the StackExchange community; if this question would be better placed in a different community/network, let me know.