原文:

It's not surprising to see even CCNP students struggle with wild card masks, so I thought this post might help. If you have other insights on wild card masks, share them here, okay? Hopefully, together, we can get our readers understand wild card masks for good!

Why students tend to get confused with wild card masks:
1. Wild card masks are usually taught within the context of Access Control Lists (ACLs) where two other "distracting" elements are included, permit & deny.
2. Students need a strong understanding of subnetting to tackle wild card masks.

So let's start by understanding a few conditions:
1. Wild card masks are used JUST to target an IP address or a group of IP addresses.
2. Wild card masks have NOTHING to do with permit or deny, so don't be confused by what ACLs use.
3. So, remember that wild card masks simply target an IP address or a group of IP addresses.

Two rules of wild card masks are:
1. 0-bit means MATCH
2. 1-bit means IGNORE

So what do wild card masks target?
1. A single host, that is, a single IP address
2. A whole network, either Class A, B, or C
3. A whole subnet
4. A consecutive range of IP addresses

If you can understand this far, you're doing just fine! Read on.

1. You want to target a single host
This means that EVERY bit in the host's IP address must MATCH. So the wild card mask is 0.0.0.0

2. You want to target a whole network
This means that EVERY bit in the network portion of the IP address must MATCH. So for Class-A, the wild card mask is 0.255.255.255. For Class-B, the wild card mask is 0.0.255.255. For Class-C, the wild card mask is 0.0.0.255.

3. You want to target a whole subnet
This means that EVERY bit in the network & the subnet portion of the IP address must MATCH. The easiest way to get your wild card mask is to subtract the subnet's subnet mask from 255.255.255.255. Here's an example: 192.168.16.16/28 has a subnet mask that looks like this, 255.255.255.240. Your wild card mask is simply 255.255.255.255 minus 255.255.255.240 which will get you 0.0.0.15. Here's another example: 172.16.4.0/24 has a subnet mask that looks like this, 255.255.255.0. Your wild card mask is simply 255.255.255.255 minus 255.255.255.0 which will get you 0.0.0.255.

4. You want to target a consecutive range of IP addresses
In this case, split the IP addresses into their networks or subnets first. Then, get your wild card mask for each network or subnet. Here's an example: For un-subnetted networks, your range is 10.1.2.3/8 to 11.3.4.5/8. Two un-subnetted Class-A networks are involved. So split into two wild card mask for each network. You now have 0.255.255.255, one for Class-A and another for Class-B network.

Well, there's yet other IP address ranges which fall WITHIN a network or a subnet. In this case, simply subtract the lower IP address from the higher IP address. To make this work, all the numbers of your resulting wild card mask must be 1 less than a multiple of two. This is beyond the scope of my post here...perhaps on another post.

Okay, I've posted this...now help me improve this content so our readers can benefit, alright? Many thanks.

讨论:

1.

Wildcard masks are also useful for matching things like say all odd or even routes. They can also be used to match some non contiguous networks.


Odd and/or Even routes:
The key behind this is to look at this from a binary perspective. Say for example you have 6x networks.

1.0.0.0/8
2.0.0.0/8
3.0.0.0/8
4.0.0.0/8
5.0.0.0/8
6.0.0.0/8

writing them out in binary you will get the following

0000001 = 1
0000010 = 2
0000011 = 3
0000100 = 4
0000101 = 5
0000110 = 6

Knowing that is you take all the bits and add them up you get a total of 255. When you look at the odd numbered prefix's you will see they all end with the last bit turned on. Taking the inverse of 1 you will get 254 (255-1). In this case the inverse mask would be

254.0.0.0

The full ACL to match all first octet odd routes is:
access-list 1 per 1.0.0.0 254.0.0.0

To match all first octet even routes. a 0 ( lowest even number ) will be used as the matching bit in the ACL:
access-list 1 per 0.0.0.0 254.0.0.0

code: