I've always wondered what the use of wild card masks was. When I learned about them in college I wondered what the use was, we saw that you could separate subnets by for instance even and uneven IPs. What is the practical use of wild card masks vs normal subnet masks?
As I understand it, the question is what is the reason for the two different masks, not what are the differences between the masks. The two questions overlap somewhat, but it comes down to binary math (as YLearn hits on).
First, a netmask:
IP: 1100 0000 . 1010 1000 . 1111 1000 . 0110 0100 = 192.168.248.100 Mask: 1111 1111 . 1111 1111 . 1111 1111 . 1111 1000 = 255.255.255.248 AND: 1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96
The AND operation on the IP address with the netmask results in the network
Next, a wildcard:
NET: 1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96 WC: 0000 0000 . 0000 0000 . 0000 0000 . 0000 0111 = 0.0.0.7 OR: 1100 0000 . 1010 1000 . 1111 1000 . 0110 0111 = 192.168.248.103
performing an OR operation on the network results in the range of IPs (192.168.248.96-103) that may be permitted or blocked in an ACL or OSPF network statement (remember that OSPF only looks for interfaces that fall within the specified ranges -- i.e. it doesn't match IP and netmask, just the IP). It's very easy to check whether an IP is in range with:
IP OR WC == NET OR WC
This is useful to the router because the netmask does not easily give you this information (without additional operations).
There are some odd corner cases you can do with wild card masks that are difficult to do with subnet masks - for example, you could do 1.2.*.4 easily in a wild card mask that would be hard to do in a subnet mask. How practical this is is left up to the operator in question.
Basically a wild card mask splits up each bit into a 'match' or 'don't care' setting. if you have 255.255.255.33. for example, that would translate to '11111111.11111111.11111111.00100001'. If the original IP was 126.96.36.199, this translates to 00000001.00000001.00000001.10001000. Using the example given, which is starting to make my brain hurt from doing binary math, only the 3 and 8th bit of the last octet would have to match the original IP in order to be a pass (along with the other 3 octets).
Wildcard masks are also used to specify source/destination subnets (or specific addresses) in access control lists. They're also used to specify protocol interfaces that OSPF will use in more "traditional" versions of IOS (NX-OS and probably IOS-XR notwithstanding).
edit: A subnet mask's job is to separate host bits from network bits. The number of 1's in the subnet mask has to be contiguous.
11111111.11111111.00000000.00000000 <-- valid subnet mask (/16) 11111111.11111111.11111000.00000000 <-- valid subnet mask (/21) 11111111.11111111.00111000.00000000 <-- whoops, invalid subnet mask
Wildcard masks are not bound by this rule (hence the term "wildcard"), therefore you can do things like Aaron had mentioned, ie:
access-list 1 permit 192.168.200.0 0.6.0.8
This will permit:
192.168.200.0 188.8.131.52 192.168.200.8 184.108.40.206