First off, I know nmap's documentation is very powerful and I have been reading through it rather extensively.
I will be scanning externally, with permission, to determine ports & services that might be left open on publicly facing assets.
I have about 750 hosts, a lot of them on different subnets. I have the individual IPs listed out in a CSV. I know that nmap can scan based on CIDR ranges to combine many of the IPs within the same subnet, but I didn't see it as necessary if nmap can just pick up each individual IP from my list.
My reasoning behind the SYN scan would be that I don't think I need to establish the full handshake to determine open ports/services. Assuming I want to test all of these hosts to determine open ports, would this syntax be sufficient for my scan? Also, does anyone know of a rough estimate for how long it may take for nmap to perform the following scan on 750 unique hosts? Any other advice?
nmap -sS -iL /user/Desktop/IPlist.csv > /user/Desktop/scanlog.txt