Wildcard mask

A wildcard mask is basically a mask of bits that indicates which parts of an IP address can assume any value. In the Cisco IOS, they are used in several places, for example:
* To indicate the size of a network or subnet for some routing protocols, such as OSPF.
* To indicate what IP addresses should be permitted or denied in access control lists (ACLs).

Quite often, a wildcard mask can basically be thought of as a subnet mask, with ones and zeros inverted; for example, a wildcard mask of 0.0.0.255 corresponds to a subnet mask of 255.255.255.0. A wildcard mask is usually used in combination with an IP address. For example, in an standard ACL, a statement like the following:

access-list 10 permit 10.0.3.0 0.0.0.255

allows data from subnet 10.0.3.0/24 to pass, that is, the first three bytes must match exactly, whereas all the bits in the fourth byte can take on any value.

However, any bits can be marked as "don't care". For example, a wildcard mask of 0.0.0.254 (binary equivalent = 00000000.00000000.00000000.11111110) in an ACL might accept (or deny) all even-numbered IP addresses in a specific network.