I am looking at scanning with nmap a large network in order to

• identify the OS of devices (-O--osscan-limit)
• probe for details of a service on a single port (I would have used -sV for all open ports)

The problem is that -sV will probe all the ports (which I do not want to do for performance reasons) and I cannot use -p to limit the ports to the one I am interested in as this impacts the OS fingerprinting. I could not find anything in the manual to limit the service probing.

Thank you for any ideas (including other approaches outside of nmap, though I would prefer to stick to nmap)