Re: Finding web servers with nmap

[y0 () dev null]

What version of nmap do you have? I am not familiar with the -PS and -PA options. There are better tools  out there to 
accomplish this task, but if you have to use nmap, I would suggest that you do not use the -P0 option, as this will 
cause nmap to scan hosts that do not actually exist. This will take an inordinate amount of time, if it finishes at 
all. I have not had much luck in using nmap in this manner.

If I had to use nmap for this, I would use the following command:

nmap -sS -v -p 80 -oG scan.log 192.168.0.0/16

Also, you can use -sV to help you determine the versions of the web servers or -O to determine operating systems.