93ab343db7
Previously tcp_check required both ICMP and TCP to pass. This caused two failure modes: hosts with ICMP rate-limiting under scan load were missed (ICMP fails → TCP never tried), and the AND logic was confusing. In TCP-only mode, proxy-ARP gateways are still filtered out because they never spoof TCP replies. Hosts with rate-limited ICMP (e.g. some WiFi APs during a full /24 sweep) are now correctly detected via TCP. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>