Wildcard masks

Wildcard masks are the used to specify range of the network addresses. They are commonly used with the routing protocols (like OSPF) access list.

Just like the subnet mask, a wildcard mask is the 32 bits long. It acts as inverted subnets masks, but with the wildcard mask, zero bits indicate that corresponding bit position must be match the same bit position in IP address. The one bit indicate that corresponding bit position does not have to the match bit position in the IP address.

Here is an example of the using wildcard mask to the include only desired interfaces in the OSPF routing processes:

Router R1 has three networks directly connected. To include only 10.0.1.0   the subnet in OSPF routing process. the following networks commands can the used:

R1(config)#router ospf 1

R1(config-router)#network 10.0.1.0 0.0.0.255 area 0

Let’s break the down wildcard part of command. To do that, we need to use binary numbers instead of the decimal notation.

10.0.1.0 = 00001010.00000000.00000001.00000000

0.0.0.255 = 00000000.0000000.00000000.11111111

The theories say that the zero bits of wildcard mask have to the match are same positions in IP address. So, let’s write the wild card mask below in IP address:

00001010.00000000.00000001.00000000

00000000.00000000.00000000.11111111

As you can see from output above, the last octet does not have to the match because, wildcard mask bits are all ones. The first 24 bits have to the match because of wildcard mask bits of all zeroes. So, in this case wildcard mask will be match all the addresses that begins with the 10.0.1.X. In our cases, only one network will match 10.0.1.0/24.

What is we want to the match both 10.0.0.0/24 & 10.0.1.0/24? Than we will have to the use different wildcard mask. We need to the use wildcard mask of 0.0.1.255. Why is that? we again need to the write down addresses in the binary:

00001010.00000000.00000000.00000000 = 10.0.0.0

00001010.00000000.00000001.00000000 = 10.0.1.0

00000000.00000000.00000001.11111111 = 0.0.1.255

From the output above, we can see that only first 23 bits have to the match (notice that the third octet of wildcard mask has 1 at the end). That means that all address in the range of 10.0.0.0 – 10.0.1.255 will be matched.