1.5 Access List Overview
1.5.6 How to use wildcard mask bits
IP access lists use wildcard masking. Wildcard masking for IP address bits uses the number 1 and the number 0 to identify how to treat the corresponding IP address bits.
  • A wildcard mask bit 0 means "check the corresponding bit value."
  • A wildcard mask bit 1 means "do not check (ignore) that corresponding bit value."

By carefully setting wildcard masks, an administrator can select single or several IP addresses for permit or deny tests. Refer to the example in the Figure .

NOTE: Wildcard masking for access lists operates differently from an IP subnet mask. A zero in a bit position of the access list mask indicates that the corresponding bit in the address must be checked; a one in a bit position of the access list mask indicates the corresponding bit in the address is not "interesting" and can be ignored.

You have seen how the zero and one bits in an access list wildcard mask cause the access list to either check or ignore the corresponding bit in the IP address . In Figure , this wildcard masking process is applied in an example.

An administrator wants to test an IP address for subnets that will be permitted or denied. Assume the IP address is Class B (first two octets are the network number) with eight bits of subnetting (the third octet is for subnets). The administrator wants to use IP wildcard masking bits to match subnets 172.30.16.0 to 172.30.31.0. Here is how to use the wildcard mask to do this:

  • To begin, the wildcard mask will check the first two octets (172.30) using corresponding zero bits in the wildcard mask.
  • Because there is no interest in individual host addresses (a host ID will not be .0.0 at the end of the address), the wildcard mask will ignore the final octet using corresponding one bits in the wildcard mask.
  • In the third octet, where the subnet address occurs, the wildcard mask will check that the bit position for the binary 16 is on and all the higher bits are off using corresponding zero bits in the wildcard mask.
  • For the final (low end) four bits in this octet the wildcard mask will ignore the value in these positions, the address value can be binary 0 or binary 1. In this way, the wildcard mask matches subnet 16, 17, 18, and so on up to subnet 31. The wildcard mask will not match any other subnets.

In this example, the address 172.30.16.0 with the wildcard mask 0.0.15.255 matches subnets 172.30.16.0 to 172.30.31.0.