I want to send one packet to the broadcast address, but wait for all responses.
If I do
ping -c 1 192.168.1.255, it sends just one packet, but it quits after getting the first response.
This quick check for hosts possibly fails nowadays. There is an increasing number of operating systems that blocks incoming ICMP/ping by default. Perhaps there are better - and possibly faster ways to achieve your goal.
If you have SNMP-read-access to the involved router(s) you might get the information (number of hosts in a network) by a simple SNMP-get-request of the corresponding traffic statistic table.