Internal Host Discovery
# 255 min host group
# min rate 6000 

nmap -Pn -n -sS -p 21-23,25,53,111,137,139,445,80,443,8443,8080 --min-hostgroup 255 --min-rtt-timeout 0ms --max-rtt-timeout 100ms --max-retries 1 --max-scan-delay 0 --min-rate 6000 -oA CLIENT-# -vvv --open -iL <IPLIST>

Internal Full Scope Hit and Run String using Syn Half scan
# 255 min host group
# min rate 1000 should be fine for internal
# Full Port Scan / --open 

nmap -Pn -n -sS -p- -sV --min-hostgroup 255 --min-rtt-timeout 25ms --max-rtt-timeout 100ms --max-retries 1 --max-scan-delay 0 --min-rate 1000 -oA <customer-#> -vvv --open -iL <IPLIST>

Internal Discovery Script using pure ACK scans