The vast majority of firewall configurations I've run into won't return "connection refused" (actually I've never seen a firewall do that, but I'll take your word for it that some do). It is also possible to configure some filewalls so that they respond to pings (whether or not the device is up -- and I've actually seen this happen). So #1 makes as much sense as pinging does in my book.