Handle invalid scan netmasks

- anything greater than /32 is just plain wrong
- anything less than a /24 is too expansive (dangerous)

v1.0.1