Index: NmapOps.cc
===================================================================
--- NmapOps.cc	(revision 32984)
+++ NmapOps.cc	(working copy)
@@ -339,6 +339,7 @@
   memset(logfd, 0, sizeof(FILE *) * LOG_NUM_FILES);
   ttl = -1;
   badsum = 0;
+  forget_after = 0; /* Unset. */
   nmap_stdout = stdout;
   gettimeofday(&start_time, NULL);
   pTrace = vTrace = false;
Index: NmapOps.h
===================================================================
--- NmapOps.h	(revision 32984)
+++ NmapOps.h	(working copy)
@@ -340,6 +340,7 @@
   FILE *nmap_stdout; /* Nmap standard output */
   int ttl; // Time to live
   int badsum;
+  int forget_after;
   char *datadir;
   /* A map from abstract data file names like "nmap-services" and "nmap-os-db"
      to paths which have been requested by the user. nmap_fetchfile will return
Index: nmap.cc
===================================================================
--- nmap.cc	(revision 32984)
+++ nmap.cc	(working copy)
@@ -307,6 +307,7 @@
          "  --ttl <val>: Set IP time-to-live field\n"
          "  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address\n"
          "  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum\n"
+         "  --forget-after <num>: Stops scanning a host after num ports are found open (EXPERIMENTAL)\n"
          "OUTPUT:\n"
          "  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,\n"
          "     and Grepable format, respectively, to the given filename.\n"
@@ -605,6 +606,8 @@
     {"spoof-mac", required_argument, 0, 0},
     {"thc", no_argument, 0, 0},
     {"badsum", no_argument, 0, 0},
+    {"forget_after", required_argument, 0, 0},
+    {"forget-after", required_argument, 0, 0},
     {"ttl", required_argument, 0, 0}, /* Time to live */
     {"traceroute", no_argument, 0, 0},
     {"reason", no_argument, 0, 0},
@@ -871,6 +874,13 @@
           exit(0);
         } else if (strcmp(long_options[option_index].name, "badsum") == 0) {
           o.badsum = 1;
+        } else if (strcmp(long_options[option_index].name, "forget-after") == 0) {
+          o.forget_after = (int)strtol(optarg, NULL, 10);
+          if (o.forget_after < 1)
+            fatal("forget-after must be an integer greater than or equal to 1");
+          error("Warning: forget-after is an experimental feature.\n%s",
+                "         forget-after also turns on --open automatically");
+          o.setOpenOnly(true);
         } else if (strcmp(long_options[option_index].name, "iR") == 0) {
           o.generate_random_ips = 1;
           o.max_ips_to_scan = strtoul(optarg, &endptr, 10);
Index: scan_engine.cc
===================================================================
--- scan_engine.cc	(revision 32984)
+++ scan_engine.cc	(working copy)
@@ -2454,6 +2454,13 @@
 }
 
 bool HostScanStats::completed() {
+  /* If the user has used the --forget-after option, we need to check if we are done */
+  if (o.forget_after && 
+        target->ports.getStateCounts(PORT_OPEN)
+        /* TODO: Check if I should add count of openfiltered (or anything else) here */
+                                  >= o.forget_after)
+      return true;
+
   /* If there are probes active or awaiting retransmission, we are not done. */
   if (num_probes_active != 0 || num_probes_waiting_retransmit != 0
       || !probe_bench.empty() || !retry_stack.empty()) {