Actually Item #1 doesn't make sense. That "connection refused" may be coming back from a firewall, not the host itself. So assuming that the host is up and pingable because a TCP connection to the echo port was refused is not appropriate.
In most cases the firewall will respond from its own IP address, however in the case of so-called "Layer 2 firewalls" or devices that are actually Ethernet bridges with proxy support for various protocols, the response may *appear* to have come from the host when in reality it came from another device on the network.
Having the module track whether the response was an active "connection refused" vs. just getting nothing back would be okay, but only the human being with the network map in front of them can determine if the response could have come from the host itself.