In the sane2 network protocol documentation one can read:
> Avoid data port
> Maybe it's possible to avoid the data port at all?
I find this item very important, not only wrt firewalls but
also to be able to use saned over a SSH tunnel.
A possibility could be to use a new RPC call: SANE_NET_READ
that would mimic sane_read. This way, the network protocol would
be much more like the suggested code flow in
http://www.sane-project.org/html/doc013.html and only a single connection would be used.
I may implement it if I find some time ;-) but I'd like to have some
opinions about it before.