I think you just do -p 80 instead of -PT 80 to scan for web servers, for example.
From man nmap pages:
Code:
nmap -sX -p 22,53,110,143,4564 198.116.*.1-127
Sends an Xmas tree scan to the first half of each of the
255 possible 8 bit subnets in the 198.116 class "B"
address space. We are testing whether the systems run
sshd, DNS, pop3d, imapd, or port 4564. Note that Xmas
scan doesn't work on Microsoft boxes due to their defi_
cient TCP stack. Same goes with CISCO, IRIX, HP/UX, and
BSDI boxes.
This is with nmap version 3.7 btw.