Understanding how Nmap does OS fingerprinting will help you considerably. For the quick answer, though, here are the relevant points:
- Nmap needs responses from 1 closed and 1 open TCP port to do a fingerprint.
- Nmap can also use ICMP and UDP responses to further refine the match.
So you can see that you are wasting valuable time scanning for SCTP ports (
-sZ) which are not used in OS fingerprinting. You wisely limit the port scanning phase to the 100-most-common ports with
-F, but you may be able to reduce that even farther if you are not on a heavily-firewalled network.
Here's an example command that ought to be a good balance of speed and accuracy:
nmap -v -sSU -pT:20-25,80,443-445,U:54321-54330 -O $TARGET
EDIT: Nmap uses ICMP responses to probes to closed UDP ports in OS detection, so scanning likely-closed UDP ports will actually be better than what I said previously (
-p U:53,111-161). Responses from open UDP ports are not used.