Telnet from a KSH or Get the OS Level

I have written a simple program to scan a subnet to see what OS’s are running on each machine on that subnet. This is internal to our company. I cannot use snmpinfo as that we don’t turn it on, so my only choice is telnet to each machine. Since I’m using a script, I have to wait until the telnet times out before it moves to the next IP address. Problem I have is: the telnet will not timeout on some switchs/routers/hubs or printers and I have to manually kill the telnet before the script will move to the next IP. Anyone know a way to fix this in a ksh script? Or have other suggestions to accomplish this?