How to create Complex Wildcard Masks

</div
One thing that all these subnets have in common is that the 8th bit is always a 0. Let’s look at the uneven subnets too:

To create an uneven subnet, the 8th bit is always a 1. This is something we can match with a wildcard. Let’s start with a wildcard that matches all even subnets:

The first two octets are the same for all the subnets, so we use all zeroes for the wildcard mask. In the third octet, we use a 1 (don’t care) for all bits except for the 8th bit…it has to match. We don’t care at all about the 4th octet.

The wildcard that we can use will be 0.0.254.255.

Want to see a real-life example? Let me show you an example of a router configured for EIGRP. This is what the routing table looks like. You see all the networks that I used in the example above:

R2#show ip route eigrp 
D    192.168.8.0/24 [90/409600] via 10.10.10.1, 00:09:51, FastEthernet0/0
D    192.168.4.0/24 [90/409600] via 10.10.10.1, 00:09:51, FastEthernet0/0
D    192.168.5.0/24 [90/409600] via 10.10.10.1, 00:00:03, FastEthernet0/0
D    192.168.6.0/24 [90/409600] via 10.10.10.1, 00:09:51, FastEthernet0/0
D    192.168.7.0/24 [90/409600] via 10.10.10.1, 00:00:03, FastEthernet0/0
D    192.168.0.0/24 [90/409600] via 10.10.10.1, 00:09:51, FastEthernet0/0
D    192.168.1.0/24 [90/409600] via 10.10.10.1, 00:00:03, FastEthernet0/0
D    192.168.2.0/24 [90/409600] via 10.10.10.1, 00:09:51, FastEthernet0/0
D    192.168.3.0/24 [90/409600] via 10.10.10.1, 00:00:03, FastEthernet0/0

Now, we will make an access-list using the wildcard mask we just found. I use 192.168.0.0 as the network address so it matches all subnets in the 192.168.x.x range.

R2(config)#ip access-list standard EVEN
R2(config-std-nacl)#permit 192.168.0.0 0.0.254.255

I can use a distribute list and refer to the access-list to filter incoming routing updates:

R2(config)#router eigrp 10
R2(config-router)#distribute-list EVEN in

After applying the distribute list, the routing table looks like this:

R2#show ip route eigrp 
D    192.168.8.0/24 [90/409600] via 10.10.10.1, 00:03:57, FastEthernet0/0
D    192.168.4.0/24 [90/409600] via 10.10.10.1, 00:03:57, FastEthernet0/0
D    192.168.6.0/24 [90/409600] via 10.10.10.1, 00:03:57, FastEthernet0/0
D    192.168.0.0/24 [90/409600] via 10.10.10.1, 00:03:57, FastEthernet0/0
D    192.168.2.0/24 [90/409600] via 10.10.10.1, 00:03:57, FastEthernet0/0

Voila! Only the even subnets are here.

We can also use the same wildcard but apply it the other way around so it matches all the uneven subnets:

We use the exact same wildcard mask, but we will use another subnet address in the access-list (192.168.1.0):

When we use this subnet as the network address then the 8th bit of the 3rd octet has to be a 1. This is what the access-list will look like:

R2(config)#ip access-list standard UNEVEN
R2(config-std-nacl)#deny 192.168.1.0 0.0.254.255
R2(config-std-nacl)#permit any

We deny all the uneven subnets and permit everything else. Let’s apply it so you can see it in action:

R2(config)#router eigrp 10
R2(config-router)#no distribute-list EVEN in
R2(config-router)#distribute-list UNEVEN in

The results will be the same:

R2#show ip route eigrp 
D    192.168.8.0/24 [90/409600] via 10.10.10.1, 00:00:02, FastEthernet0/0
D    192.168.4.0/24 [90/409600] via 10.10.10.1, 00:00:02, FastEthernet0/0
D    192.168.6.0/24 [90/409600] via 10.10.10.1, 00:00:02, FastEthernet0/0
D    192.168.0.0/24 [90/409600] via 10.10.10.1, 00:00:02, FastEthernet0/0
D    192.168.2.0/24 [90/409600] via 10.10.10.1, 00:00:02, FastEthernet0/0

Are you following me so far? Let’s try a more complex example!

Matching “random” subnets

This is an example that you might encounter on a test. Let me show you a couple of subnets:

192.168.10.0 /24
192.168.26.0 /24
192.168.42.0 /24
192.168.58.0 /24

These subnets look random to us, but on a binary level, they have something in common. To see this, we need to dive into the binary world: