diff --git a/tools/nut-scanner/nut-scanner.c b/tools/nut-scanner/nut-scanner.c
index 67da2806e5..60579a17e4 100644
--- a/tools/nut-scanner/nut-scanner.c
+++ b/tools/nut-scanner/nut-scanner.c
@@ -593,6 +593,15 @@ static void handle_arg_cidr(const char *arg_addr, int *auto_nets_ptr)
 
 					upsdebugx(5, "Discovering getifaddrs(): %s", msg);
 
+					if (!(
+						(auto_nets == 46
+					     || (auto_nets == 4 && ifa->ifa_addr->sa_family == AF_INET)
+					     || (auto_nets == 6 && ifa->ifa_addr->sa_family == AF_INET6) )
+					)) {
+						upsdebugx(6, "Subnet ignored: not of the requested address family");
+						continue;
+					}
+
 					if (masklen_hosts_limit < masklen_hosts) {
 						/* NOTE: masklen_hosts==0 means
 						 * an exact hit on one address,
@@ -617,15 +626,6 @@ static void handle_arg_cidr(const char *arg_addr, int *auto_nets_ptr)
 						continue;
 					}
 
-					if (!(
-						(auto_nets == 46
-					     || (auto_nets == 4 && ifa->ifa_addr->sa_family == AF_INET)
-					     || (auto_nets == 6 && ifa->ifa_addr->sa_family == AF_INET6) )
-					)) {
-						upsdebugx(6, "Subnet ignored: not of the requested address family");
-						continue;
-					}
-
 					/* TODO: also rule out "link-local" address ranges
 					 * so we do not issue billions of worthless scans.
 					 * FIXME: IPv6 may also be a problem, see