Read one bit by bit
Take 10.40.8.0 with wildcard 0.0.7.255. The first two wildcard octets are zero, so 10.40 must match exactly. The third is 7, binary 00000111: the top five bits must match those of 8 (00001000) and the bottom three are free, so third octets 8 through 15 match. The last octet is ignored entirely. The entry covers 10.40.8.0 to 10.40.15.255, the same block as 10.40.8.0/21.
The subtraction shortcut
For a contiguous mask, take 255.255.255.255 and subtract the mask octet by octet. 255.255.255.192 (/26) becomes 0.0.0.63; 255.255.248.0 (/21) becomes 0.0.7.255. Check the result: the non-zero wildcard octet should be one less than a power of two.
Wildcards no subnet mask can express
Each wildcard bit is independent, so 0.0.254.255 is legal in an ACL. Paired with 10.40.1.0 it matches every address whose third octet is odd, a pattern no prefix length describes. Treat it as proof of how matching works, not as a pattern to memorize.
host and any
host 10.40.9.17 is shorthand for 10.40.9.17 with wildcard 0.0.0.0: every bit must match. any stands for 0.0.0.0 with wildcard 255.255.255.255: no bit matters.
Prefix, mask and wildcard
| Prefix | Subnet mask | Wildcard | Addresses matched |
|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,216 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,536 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,048 |
| /26 | 255.255.255.192 | 0.0.0.63 | 64 |
| /29 | 255.255.255.248 | 0.0.0.7 | 8 |
| /32 | 255.255.255.255 | 0.0.0.0 (host) | 1 |
Wildcard logic per Cisco’s Configure IP Access Lists guide.
Test an address against an entry
Flip the wildcard
Invert every bit to get the compare mask: 0.0.7.255 becomes 255.255.248.0.
Mask the packet’s address
AND the address with the compare mask. 10.40.13.200 gives 10.40.8.0; 10.40.16.3 gives 10.40.16.0.
Mask the entry’s address
Do the same to the address in the ACL line. 10.40.8.0 stays 10.40.8.0.
Compare
Equal results mean a match. 10.40.13.200 matches the entry; 10.40.16.3 moves on to the later lines, and if none matches, the implicit deny at the end drops it.
One wildcard, two jobs
The same block selected by an ACL and by OSPF
ip access-list standard BRANCH-21 permit 10.40.8.0 0.0.7.255 deny any log!router ospf 1 network 10.40.8.0 0.0.7.255 area 0 network 172.20.5.1 0.0.0.0 area 0The ACL entry selects packets with a source in 10.40.8.0/21. The first OSPF line enables OSPF on every interface whose address falls in that block; the second enables exactly one interface, the one addressed 172.20.5.1.
Same mask, different planes
The two uses live on different planes of the router. The ACL acts on packets as they are forwarded, which is data-plane work; the OSPF statement decides where the routing protocol speaks, which is control-plane work. That split is mapped on control plane vs data plane.
Wildcards come up under two topics in each version: ACLs (v1.1 5.6, v2.0 4.6) and OSPF (v1.1 3.4, v2.0 3.3), per Cisco’s v1.1 and v2.0 topic lists.
Frames on Wildcard vs subnet mask
Convert before you compare: write each option’s mask in binary when two of them look close.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 006 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 006
What is the wildcard mask for a subnet with a prefix length of /30?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
0.0.0.255 is the wildcard for a /24, which leaves 8 host bits free.
Note on B
Correct: a /30 leaves 2 host bits, and 2 bits set to 1 give 0.0.0.3, the inverse of 255.255.255.252.
Note on C
0.0.0.15 is the wildcard for a /28, with 4 host bits.
Note on D
0.0.0.7 matches a /29, which has 3 host bits.
Best answer: B · why
A wildcard mask is the inverse of the subnet mask: subtract each octet from 255. A /30 mask is 255.255.255.252, so the wildcard is 0.0.0.3. In a wildcard, 0 bits must match and 1 bits are ignored. Other common pairs: /24 = 0.0.0.255, /28 = 0.0.0.15, /29 = 0.0.0.7, and a single host is 0.0.0.0.
- Frame 002 of 006
When configuring access control lists (ACLs) on a router, which wildcard mask would you use to match all IP addresses in the 192.168.1.0 network?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
255.0.0.0 looks like a subnet mask; as a wildcard it would ignore the first octet and fix the other three.
Note on B
0.255.255.255 fixes only the first octet, so it would match all of 192.0.0.0/8.
Note on C
Correct: 0.0.0.255 fixes the first three octets (192.168.1) and ignores the last, so it matches the whole /24.
Note on D
255.255.255.0 is the subnet mask; used as a wildcard it would ignore the first three octets and match only on the last.
Best answer: C · why
In an ACL, a wildcard bit of 0 means the address bit must match, and 1 means ignore it. To match every host in 192.168.1.0/24, the first three octets must match and the fourth can be anything, so the wildcard is 0.0.0.255: access-list 10 permit 192.168.1.0 0.0.0.255. A wildcard is the inverse of the subnet mask, not the mask itself.
- Frame 003 of 006
If a router is misconfigured with an incorrect wildcard mask in its OSPF network command, how could this affect IP connectivity within the OSPF area?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
A wrong wildcard does not filter routes in any helpful way; it just changes which interfaces join OSPF.
Note on B
IOS does not correct wildcard masks; it applies exactly what was entered.
Note on C
The network command and its wildcard belong to OSPFv2 and IPv4, so a mistake there hits IPv4, not IPv6.
Note on D
Correct: the network statement selects interfaces by address and wildcard, so a wrong mask can leave interfaces out, and their subnets are not advertised.
Best answer: D · why
In OSPFv2, network <address> <wildcard> area <id> enables OSPF on every interface whose IP falls inside that range. A wildcard that is too narrow leaves interfaces out: no Hellos are sent there, no neighbors form, and the connected subnet is not advertised, so other routers lose those routes. One that is too broad can enable OSPF where it is not wanted. Check the result with show ip ospf interface brief.
- Frame 004 of 006
An ACL entry must match every address in 172.16.16.0/20 and no other address. Which address and wildcard mask should the entry use?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
16 in the third octet is not a contiguous run of host bits. The wildcard is 255 minus 240, which is 15, not the block size of 16.
Note on B
Correct. A /20 mask is 255.255.240.0, and its inverse is 0.0.15.255, which leaves 172.16.16.0 through 172.16.31.255 free to vary.
Note on C
This is the subnet mask written where a wildcard belongs. ACLs read 0 bits as must-match, so this would match the wrong addresses.
Note on D
0.0.0.15 frees only the last 4 bits, which covers a /28 of 16 addresses, not the 4,096 addresses of a /20.
Best answer: B · why
In an ACL wildcard mask, a 0 bit means the address bit must match and a 1 bit means it can be anything. For a prefix, the wildcard is the inverse of the subnet mask: subtract each octet from 255. A /20 has the mask 255.255.240.0, so the wildcard is 0.0.15.255. With 172.16.16.0 it matches 172.16.16.0 to 172.16.31.255 and nothing else. Writing the subnet mask itself, or confusing the block size of 16 with the wildcard value of 15, are the classic slips. Source: Cisco’s document on configuring IP access lists.
- Frame 005 of 006
Which ACL entry matches exactly the same traffic as ‘access-list 10 permit host 192.0.2.7’?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct. The host keyword is shorthand for the wildcard 0.0.0.0, which requires every bit to match, so only 192.0.2.7 is permitted.
Note on B
All ones means every bit may vary, so this matches any address. It is the same as the any keyword, not host.
Note on C
One free bit matches two addresses, 192.0.2.6 and 192.0.2.7, so it permits more than the single host.
Note on D
This is a subnet mask used as a wildcard. It frees the first three octets and matches any address ending in .7.
Best answer: A · why
ACLs offer two keywords that stand for wildcard masks. ‘host 192.0.2.7’ is the same as ‘192.0.2.7 0.0.0.0’: a wildcard of all zeros means every bit must match, so exactly one address is matched. ‘any’ is the same as ‘0.0.0.0 255.255.255.255’: all ones means every bit may vary. Any other wildcard frees some bits and so matches more than one address. Reading a mask such as 255.255.255.0 as if it were a subnet mask is a common slip, since in a wildcard it frees the first three octets instead. Source: Cisco’s document on configuring IP access lists.
- Frame 006 of 006
R1 has three interfaces: Gi0/0 10.1.4.1/24, Gi0/1 10.2.0.1/24 and Se0/0/0 10.1.200.1/30. The only statement under ‘router ospf 1’ is ‘network 10.1.0.0 0.0.255.255 area 0’. Which interfaces are enabled for OSPF?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The statement is 10.1.0.0 with a wildcard that fixes the second octet too. 10.2.0.1 fails the match on that octet.
Note on B
The value is a wildcard, not a subnet mask. In a network statement, 0.0.255.255 is valid and matches any address that starts with 10.1.
Note on C
Correct. The wildcard fixes the first two octets at 10.1 and frees the rest, so 10.1.4.1 and 10.1.200.1 match and 10.2.0.1 does not.
Note on D
The network statement checks only the interface address against the wildcard. The interface’s own prefix length plays no part.
Best answer: C · why
An OSPF network statement uses an address and a wildcard mask, read like an ACL: 0 bits must match and 1 bits are ignored. Any interface whose primary IPv4 address matches is enabled for OSPF in the named area. 0.0.255.255 requires the first two octets to equal 10.1 and ignores the last two. So Gi0/0 (10.1.4.1) and Se0/0/0 (10.1.200.1) join area 0, whatever their own masks, while Gi0/1 (10.2.0.1) does not. Reading the wildcard as a subnet mask, or comparing prefix lengths, gives the wrong set. Source: Cisco’s document on configuring IP access lists (wildcard rules), which OSPF network statements share.