Yeah, someone scanning a /8 with ettercap will have lots of issues :) Or at least the network admin will! As for the timeout, the problem of decreasing it is that we could potentially miss live hosts because we did not get a response in time. There's always that risk and trade-off. Network scan is assumed to be slow, let me test this one