The Cautious Approach: List Scan (Some IP's and hostnames slightly obscured) nmap -sL -oN foocorp-listscan.nmap 216.163.128.0/20 200.247.228.0/24 216.80.23.104/29 207.229.165.80/29 216.80.21.72/29 216.80.43.240/29 216.80.23.160/29 195.244.204.101-105 [ ... ] Host unknown.Level3.net (200.247.228.200) not scanned Host free-chi.foocorp.com (200.247.228.201) not scanned Host cyber-chi.foocorp.com (200.247.228.202) not scanned Host move-chi.foocorp.com (200.247.228.203) not scanned Host network-chi.foocorp.com (200.247.228.204) not scanned Host store.foocorp.com (200.247.228.205) not scanned Host virt.foocorp.com (200.247.228.206) not scanned Host secure.foocorp.com (200.247.228.207) not scanned Host unknown.Level3.net (200.247.228.208) not scanned Host www.foocorpenterprises.com (200.247.228.209) not scanned Host ads-chi.foocorpcommerce.com (200.247.228.210) not scanned Host store.foocorptv.com (200.247.228.211) not scanned Host unknown.Level3.net (200.247.228.212) not scanned [ ... ] Nmap run completed -- 4397 IP addresses (0 hosts up) scanned in 314.046 seconds