This is what NetEdit does to open a connection to a specified device, without using broadcast. TP is the transport you opened previously. The key parameter is the UseAddressedBroadcast being set to FALSE.
If you want to scan a bunch of addresses and the network environment is fast, that timeout can be much, much lower.
pHEIDev->Address.AddressIP.Family = AF_INET;
pHEIDev->Address.AddressIP.Port = 0x7070;
pHEIDev->Address.AddressIP.AddressingType.bAddr.b1 = IPAddr[0];
pHEIDev->Address.AddressIP.AddressingType.bAddr.b2 = IPAddr[1];
pHEIDev->Address.AddressIP.AddressingType.bAddr.b3 = DevIPAddr[2];
pHEIDev->Address.AddressIP.AddressingType.bAddr.b4 = IPAddr[3];
HEIOpenDevice(&TP, pHEIDev, HEIAPIVERSION, 2000, 1, FALSE);