./nmap-old -v 127.0.0.1/18 -T5 -P0 -sS -n -p22 > /dev/null  4.18s user 0.71s system 97% cpu 5.012 total
./nmap -v 127.0.0.1/18 -T5 -P0 -sS -n -p22 > /dev/null  1.01s user 0.64s system 91% cpu 1.805 total

./nmap 127.0.0.1 -T5 -P0 -sS -n -pT:-  1.66s user 3.27s system 99% cpu 4.935 total
./nmap 127.0.0.1 -T5 -P0 -sS -n -pT:- -r  1.35s user 3.28s system 99% cpu 4.642 total

Index: /home/majek/.workspace/SVNnmap/scan_engine.cc
===================================================================
--- /home/majek/.workspace/SVNnmap/scan_engine.cc	(revision 3524)
+++ /home/majek/.workspace/SVNnmap/scan_engine.cc	(working copy)
@@ -560,7 +560,7 @@
      Returns NULL if none are found. */
   HostScanStats *findIncompleteHost(struct sockaddr_storage *ss);
 
-  unsigned int numIncompleteHosts() { return incompleteHosts.size(); }
+  unsigned int numIncompleteHosts() { return incompleteHosts_size; }
   unsigned int numInitialHosts() { return numInitialTargets; }
   /* Any function which messes with (removes elements from)
      incompleteHosts may have to manipulate nextI */
@@ -575,6 +575,9 @@
 		  numbers.  It is set randomly in UltraScanInfo::Init() */
 private:
 
+  /* This variable should hold the same data as incompleteHosts.size(),
+   * but using this is much faster than counting size() */
+  long incompleteHosts_size;
   unsigned int numInitialTargets;
   list<HostScanStats *>::iterator nextI;
 
@@ -1089,9 +1092,10 @@
 }
 
 UltraScanInfo::~UltraScanInfo() {
-  while(!incompleteHosts.empty()) {
+  while(numIncompleteHosts()) {
     delete incompleteHosts.front();
     incompleteHosts.pop_front();
+    incompleteHosts_size--;
   }
   delete gstats;
   delete SPM;
@@ -1107,7 +1111,7 @@
 HostScanStats *UltraScanInfo::nextIncompleteHost() {
   HostScanStats *nxt;
 
-  if (incompleteHosts.empty())
+  if (numIncompleteHosts() ==0)
     return NULL;
 
   nxt = *nextI;
@@ -1145,7 +1149,8 @@
   unsigned int targetno = 0;
   HostScanStats *hss;
   int num_timedout = 0;
-
+  incompleteHosts_size = 0;
+  
   gettimeofday(&now, NULL);
   init_perf_values(&perf);
 
@@ -1157,6 +1162,7 @@
 
     hss = new HostScanStats(Targets[targetno], this);
     incompleteHosts.push_back(hss);
+    incompleteHosts_size++;
   }
   numInitialTargets = Targets.size();
 
@@ -1321,7 +1327,7 @@
     timedout = hss->target->timedOut(&now);
     if (hss->completed() || timedout) {
       /* A host to remove!  First adjust nextI appropriately */
-      if (nextI == hostI && incompleteHosts.size() > 1) {
+      if (nextI == hostI && numIncompleteHosts() > 1) {
 	nextI++;
 	if (nextI == incompleteHosts.end())
 	  nextI = incompleteHosts.begin();
@@ -1327,7 +1333,7 @@
 	  nextI = incompleteHosts.begin();
       }
       if (o.verbose && gstats->numprobes > 50) {
-	int remain = incompleteHosts.size() - 1;
+	int remain = numIncompleteHosts() - 1;
 	if (remain && !timedout)
 	  log_write(LOG_STDOUT, "Completed %s against %s in %.2fs (%d %s)\n",
 		    scantype2str(scantype), hss->target->targetipstr(), 
@@ -1339,6 +1345,7 @@
 		    (remain == 1)? "host left" : "hosts left");
       }
       incompleteHosts.erase(hostI);
+      incompleteHosts_size--;
       hostsRemoved++;
       if (timedout) gstats->num_hosts_timedout++;
       hss->target->stopTimeOutClock(&now);
@@ -1610,8 +1617,18 @@
 }
 
 bool HostScanStats::completed() {
-  return num_probes_active == 0 && num_probes_waiting_retransmit == 0 && 
-    probe_bench.empty() && retry_stack.empty() && freshPortsLeft() == 0;
+
+  if(num_probes_active != 0 || num_probes_waiting_retransmit != 0 ||
+     freshPortsLeft() != 0)
+    return(false);
+     
+
+  if(!probe_bench.empty())
+    return(false);
+  
+  if(!retry_stack.empty())
+    return(false);
+  return(true);
 }
 
 /* Encode the trynum into a 32-bit value.  A simple checksum is also included