Scanning subnets w/CIDR

["Mark E. Drummond" <mark.drummond () rmc ca>]

I have a class B net, chopped up into variously sized subnets. Can the "/##"
an address spec be any sized mask? /22 ? /20 ?

Also, I noticed that nmap will scan the net address and broadcast address
themselves. Should it not be coded to not scan these? Or perhaps a more
flexible language for specifying address such as "x.x.x.x/xx EXCEPT x.x.x.x
..." ?

-- 
Mark Drummond
Department of Computing Services
UNIX System Administrator