Nmap Hackers: Re: Scanning subnets w/CIDR

[Andrew Brennan <andrew.brennan () drexel edu>]

On Tue, 7 Mar 2000, Mark E. Drummond wrote:

> I have a class B net, chopped up into variously sized subnets. Can the "/##"
> an address spec be any sized mask? /22 ? /20 ?
   I've been scanning variably sized subnets w/o any trouble (except when
   I forget and scan the wrong subnet).  /18 /20, etc. is no problem.

> Also, I noticed that nmap will scan the net address and broadcast address
> themselves. Should it not be coded to not scan these? Or perhaps a more
> flexible language for specifying address such as "x.x.x.x/xx EXCEPT x.x.x.x
> ..." ?
   I'd think that you'd be better having it not scan the net & broadcast
   for the specified net mask with an override switch to force the other
   behavior.  It gets the functionality you suggest w/o changing any of 
   the language/grammar ... or minimally so.

   andrew.