Finding open VNC hosts with nmap
Say you have a machine using DHCP that you only boot up once in a while. It's headless, so you need to remote into it. How can you find out what IP it has? Here is quick command to scan for open VNC ports on the 172.27.1.* sub-net.
nmap -p 5900 172.27.1.0/24 --open |grep Interesting