Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration:

* All ICMP traffic is blocked
* An IDS or some device returns all ports as filtered when scanning with nmap, using sT, sN and sS scans.
* Even running at -T0 or -T1, any port is returned as filtered. Scanning a single port, eg -p 65544 before doing a full scan shows it as filtered also.

Only a very small percentage of hosts will seem to be actually up, i.e. having a port accessible on the server.

The problem with the IDS reporting many ports as "filtered" for a host means nmap considers it live. 

Sometimes I run into this problem with very very large ranges. Determining the amount of live hosts can save time on the assessment, and so I am looking for a way to automate in some fashion.

If the only answer to to only use hosts that have at least one port as "open", is there a way to script nmap to ignore ports considered "filtered"? 

I should also note, ARP is not an option here due to this being an external scan across the internet, and there is no pivot point.