Understanding Wildcard Masks

Introduction to Wildcard Masks
Before I begin, I should mention how important it is that you have solid binary to decimal and decimal to binary math skills.  In order to develop these masks (and understand them) at the the fastest speed possible, you need to know your math.  So if you are weak in this area, now would be a good time to practice!  Cisco has a binary math game on the Cisco Learning Network.  You can find it here, but note that you will need a Cisco login and username.  If you aren't on the Cisco Learning Network, I highly encourage you to sign up! They have great study resources and places where you can ask questions on concepts that you don't understand.


Wildcard Mask Logic
When you write an ACL statement, you identify the addresses that you want to either deny or permit access to by matching it with a wildcard mask.  The logic behind comparing an IP address with the mask is this:

• For each 0 in each octet of the wildcard mask, the IP address that is being compared against the network statement must match in the corresponding octet.
• At the binary level, each 0 must means the IP address binary must match the corresponding bit value of the network statement
• Anything other then zero indicates the acceptable range of IP addresses that do not have to match the network statement
• At the binary level, each 1 means that the IP address binary does not have to match the corresponding bit value of the network statement

It's likely that you may be confused after reading these "rules".  If so, write these down or copy and paste them into a file and compare the rules against the following examples as you go through them.

Also, before I get started with these, understand that there are shortcuts to creating wildcard masks, and once you get good at it, you can write them out much faster then breaking it down into the binary.  The problem is that if you don't understand what is happening at the binary level, you will really be missing out, especially when it comes to creating some more..interesting ACL statements (I'll throw in one at the bottom of this post).

Example 1
The following ACL would match any host with a source IP from the network 10.0.0.0/24 and apply the "deny" action, preventing the traffic from passing through the interface

deny ip 10.0.0.0 0.0.0.255

IP address 10.0.0.1 would match this statement.  Why?  Lets look at this at the bit level

wildcrd mask:  00000000.00000000.00000000.11111111

network addr: 00001010.00000000.00000000.00000000

ip address    :  00001010.00000000.00000000.00000001

In green, I have highlighted the bit values that must match, given the wildcard mask.  As you can see, the IP address will be matched as long as the bit values in the first three octets are the same-or the address begins with 10.0.0.X  and the fourth octet, as the wildcard mask is all 1's here, can be any value.  So network addresses 10.0.0.1-10.0.0.255 will be matched.

Excercise 1

Lets try a basic wildcard mask excersise.

Determine the range of addresses that will be matched and denied by the following ACL statement. 

deny ip 192.168.0.0 0.0.1.255

Begin by breaking down the network statement and wildcard masks down into binary.  Determine which bits must match, and which do not.  Finally, do the math on the bits that do not have to match to determine the acceptable range of addresses that will be matched by this statement.  When you think you have it, jump down to see the answer!

Excercise 1 answer: Addresses 192.168.0.1 - 192.168.1.255

Start by breaking down the network statement (192.168.0.0)  and wildcard mask (0.0.1.255) into their associated bits.

    mask : 00000000.00000000.00000001.11111111

network: 11000000.10101000.00000000.00000000

Now that you have your mask and network in binary form, you know which bit values must match.  Here, you can see that the address must at least be 192.168.X.X  for the first two octets.  The third octet can be confusing when you are doing this for the first time.  The wildcard mask is a 1 for the 8th bit value of the third octet.  Remembering the previous rules, you know that a "1" value means the mask does not check this bit.  Therefore, the bit can either be on or off, and the remaining octet is entirely composed of 1's.  Therefore, the acceptable range of possible network addresses is 192.168.0.1-192.168.1.255

Excercise 2: Determine if an Address will be matched

Given the following ACL statement, determine if address 192.10.16.224 will be matched

deny ip 192.10.0.0 0.0.15.255

Solve this by taking your network statement, wildcard mask, and IP address, and breaking them down into binary.  When you think you have the answer, jump down to check and see an explanation

Answer: No, because the range of addresses that will be matched is 192.10.0.1-192.10.15.255

Begin by breaking down your addresses into bit values.

mask:    00000000.00000000.00001111.11111111

network:11000000.00001010.00000000.00000000

address: 11000000.00001010.00010000.11100000

Now you see that when you break it down into binary, how simple the wildcard masks really become. As an added bonus, by repeating this practice, you get to improve on your binary to decimal math skills-a skill that in my opinion, is essential if you want any chance at passing the CCNA. In this above example, the "1" value in the address in the fourth digit of the third octet, does not match the mask!  According to the mask, that value must be a 0.  Since it is not, the address will not be matched and will be ignored.  How did I determine the acceptable range?  Math-you can see that the "1's" begin in the fifth digit of the third octet.  This place has a value of 8.  8+4+2+1 = 15.  So you know that in the third octet, the acceptable values are 0 through 15.  The fourth octet is composed entirely of 1's and is ignored by the mask.  Therefore, your acceptable range is 192.10.0.1-192.10.15.255

Shortcuts..

Some of you may be aware of a few shortcuts.  An example of one, is that the wildcard mask itself is the upper most limit of the value in each octet that can be matched.

0.0.15.255

is the same as our range 192.10.0.1-192.10.15.255

However, now I will show you the problem with relying entirely on shortcuts.  Lets say you have a network

10.0.0.0 and you want to only match IP addresses with an even number (maybe you have an eccentric networking scheme and all of your hosts have an even IP address).  So, you only want to match IP addresses 10.0.0.2, 10.0.0.4, 10.0.0.6, and so on.  How do you determine this?  Unfortunately, the shortcut method, will not work here.  You need to understand how this works at the bit level.  Breaking it down, you can see how you would perform this task:

mask:     00000000.00000000.00000000.11111110

network:00001010.00000000.00000000.00000000

Because the last value of the fourth octet must be turned "off", mathematically, you cannot have any odd numbers!  So, any IP address in the 10.0.0.X network with an even number in the fourth octet will be matched.

I find that the shortcuts can be handy-as long as you fully understand what is taking place when you apply them.  In my experience, if I rely only on the shortcuts, I tend to forget what is taking place, and I don't keep my understanding of the matching logic as sharp as I need to.  You can find a number of these shortcuts in other tutorials, but the only other one that I sometimes use is what I term the "magic number - 1" shortcut.  Say for example you wanted to build a wildcard mask that would block addresses in the 10.0.0.1-10.0.0.3 range.  You know that by looking at this range, this would be a /30 address.  The "magic number" (or incremental value) of a /30 is 4.  Subtract one, and you would get the value you would need for your wildcard mask, or 0.0.0.3.  At the binary level, we know this is true, because if you add the values of the last two bits together, you get 3.  So the mask 0.0.0.3 will match addresses 10.0.0.1, 10.0.0.2, and 10.0.0.3.  You know it won't match 10.0.0.4 and up because the values of those bits must be equal to 0 in order to be matched by the wildcard logic.