A company has five different subnets: 192.168.1.0, 192.168.2.0, 192.168.3.0, 192.168.4.0 and 192.168.5.0. How can NMAP be used to scan these adjacent Class C networks?

Nmap's range notation allows you to specify a range within any octet using a hyphen, so '192.168.1-5.0' targets only the third octets 1 through 5, precisely matching the five subnets 192.168.1.0 through 192.168.5.0. This is more precise than a CIDR block that would include unintended addresses, and it is the correct Nmap syntax for this use case.

192.168.0.0/16 is a /16 CIDR block covering all 65,536 addresses in the entire 192.168.x.x space, which vastly exceeds the five target subnets and would scan many unintended hosts.

Comma-separated partial octets like '192.168.1.0,2.0,3.0,4.0,5.0' is not valid Nmap syntax; Nmap does not parse partial-octet comma lists in that format.

'192.168.1/17' is not valid Nmap or CIDR notation because the CIDR prefix must follow a complete IP address, and /17 would not map to the five specific subnets listed.