In HKLM/Microsoft/MSSQLServer/MSSQLServer/SuperSocketNetLib there's a TCP key and a TCPPort flag below that you can scan. That's W2K, not sure about other versions.
You can use some port scan tool, like nmap, to scan your network. Not sure how it will scan non-standard ports. The best thing is to require SQL srevers to be on specific ports, set a standard for named instances, and then scan those ports. You can use firewalls to cut down traffic between subnets to enforce this. Other than that, not sure how easy it is to detect SQL Servers. You'd have to scan all ports for the listener.