I want to send one packet to the broadcast address, but wait for all responses.
If I do
ping -c 1 192.168.1.255, it sends just one packet, but it quits after getting the first response.
ping know that the responses it got really are all of them?
-sn(No port scan)
This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan. This is often known as a “ping scan”,[...]
Systems administrators often find this option valuable as well. It can easily be used to count available machines on a network or monitor server availability. This is often called a ping sweep, and is more reliable than pinging the broadcast address because many hosts do not reply to broadcast queries.
This quick check for hosts possibly fails nowadays. There is an increasing number of operating systems that blocks incoming ICMP/ping by default. Perhaps there are better - and possibly faster ways to achieve your goal.
If you have SNMP-read-access to the involved router(s) you might get the information (number of hosts in a network) by a simple SNMP-get-request of the corresponding traffic statistic table.