nmap -p T:1433 -sV 192.168.1.2-254 -oG tcp_scan_results.txt

Source: https://www.mssqltips.com/sqlservertip/2753/using-nmap-to-scan-for-sql-servers-on-a-network/