nice script. came up with this some moons ago:

  seq \
  --equal-width 1 65535 | \
    xargs \
      --max-procs 16 \
      --max-args 1 \
      --replace=_$ \
        nc \
   --verbose \
   -z \
          --wait 1 \
   ${TARGET_HOST} _$ 2>&1 | \
     grep --ignore-case --only-matching --regexp "connected.*"

Served me needs on local subnets