Scan everything; all ports and protocols.
Scan of open TCP ports:
- Scanner sends TCP SYN to 1650 targets × 65,536 ports = 108,132,750 160-bit IP headers + 108,132,750 160-bit TCP SYN packets = 34,602,480,000 bits @ 1 Gbit/s = 32.23 seconds; of course, you'll have to go at least twice as slow so that responses from below can use the bandwidth.
- 1650 targets × 65,535 ports respond with 108,132,750 96-bit ICMP PORT_UNREACH packets or 108,132,750 160-bit IP headers + 160-bit TCP SYN-ACK payload = not more than 34,602,480,000 bits @ 1 Gbit/s = at least 32.23 seconds.
- All listening TCP ports on all systems on your network can, theorethically, be discovered in 64.45 seconds if there's no packet loss (OSI layer 2 frame sizes not taken into account).
It's similar for UDP; however, the payload is smaller.
The discovery of all listening TCP and UDP ports on all systems on your network can, theorethically, be completed in 128.90 seconds (OSI layer 2 frame sizes not taken into account).
Other protocols = 1 packet per target in each direction; however, DHCP servers wait on each other, so to discover all of them is a bit more complicated.
I'd say all directly available services on your network can, theorethically, be determined within 180 seconds.
Then you have to scan each directly available service for vulnerabilities. A rough estimate would be that you have 1650 × 5 available servies = 8,250 directly available services. I'd say it would take no more than 10 seconds per directly available service on average. Therefore, all directly avaialble services can, theorethically, be scanned for vulnerabilities within 180 seconds + 8,250 × 10 seconds = 82,680 seconds = 22.97 hours.
Realistically, it will take at least 3 days @ 1 Gbit/s.
Now, just so you know, a hacker could discover all vulnerable standard services on your network within a few hours, if he's a script kiddie, or within an hour, if he's not. That is to say, your entire network can be pwned within 3 hours if there's an entry point and there are vulnerabilities, depending on who's doing it.
That's only IPv4, though; do you have IPv6?