13

I've always wondered what the use of wild card masks was. When I learned about them in college I wondered what the use was, we saw that you could separate subnets by for instance even and uneven IPs. What is the practical use of wild card masks vs normal subnet masks?

  • So basically the wild card mask bypasses the uses of a subnet mask because its easier is binary to calculate because of reverse binary. – user24602 Apr 15 '16 at 18:48
  • Little mistyping there. But binary speaking its use is easier then a standard subnet mask? – user24602 Apr 15 '16 at 18:50
  • Are you meaning to ask a question? If so, you are using an answer to ask the question. An answer is meant to answer the original question. If you want to ask a question, start a new question. – Ron Maupin Apr 15 '16 at 18:52
7

As I understand it, the question is what is the reason for the two different masks, not what are the differences between the masks. The two questions overlap somewhat, but it comes down to binary math (as YLearn hits on).

First, a netmask:

IP:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0100 = 192.168.248.100
Mask: 1111 1111 . 1111 1111 . 1111 1111 . 1111 1000 = 255.255.255.248
AND:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96

The AND operation on the IP address with the netmask results in the network 192.168.248.96/29.

Next, a wildcard:

NET:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96
WC:   0000 0000 . 0000 0000 . 0000 0000 . 0000 0111 = 0.0.0.7
OR:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0111 = 192.168.248.103

performing an OR operation on the network results in the range of IPs (192.168.248.96-103) that may be permitted or blocked in an ACL or OSPF network statement (remember that OSPF only looks for interfaces that fall within the specified ranges -- i.e. it doesn't match IP and netmask, just the IP). It's very easy to check whether an IP is in range with:

IP OR WC == NET OR WC

This is useful to the router because the netmask does not easily give you this information (without additional operations).

| improve this answer | |
12

There are some odd corner cases you can do with wild card masks that are difficult to do with subnet masks - for example, you could do 1.2.*.4 easily in a wild card mask that would be hard to do in a subnet mask. How practical this is is left up to the operator in question.

Basically a wild card mask splits up each bit into a 'match' or 'don't care' setting. if you have 255.255.255.33. for example, that would translate to '11111111.11111111.11111111.00100001'. If the original IP was 1.1.1.200, this translates to 00000001.00000001.00000001.10001000. Using the example given, which is starting to make my brain hurt from doing binary math, only the 3 and 8th bit of the last octet would have to match the original IP in order to be a pass (along with the other 3 octets).

| improve this answer | |
  • Indeed that's what I was wondering about what the practical uses are – Lucas Kauffman May 21 '13 at 21:19
  • 255.255.0.255 - pretty simple if you ask me – Olipro May 21 '13 at 22:26
  • 1
    That's not a valid subnet mask. – John Jensen May 21 '13 at 22:30
  • 2
    it's perfectly valid, it's just not valid for the purposes of configuring an address in a CIDR-based environment. On a firewall or other system that doesn't care about it being a longest-prefix compliant mask, it's completely valid. iptables or an access-list are a good example. Computers aren't magic, 1.2.x.4 is identical to 255.255.0.255 in terms of bitmasking, it's the difference between a regex and a logical AND. – Olipro May 22 '13 at 0:45
  • 1
    Don't try to play semantics with me, "subnet mask" and "wildcard mask" are equally misnomers. Nowhere did I use the word "subnet mask" in my statement. a mask is a mask, what matters is its purpose. – Olipro May 22 '13 at 1:34
5

Wildcard masks are also used to specify source/destination subnets (or specific addresses) in access control lists. They're also used to specify protocol interfaces that OSPF will use in more "traditional" versions of IOS (NX-OS and probably IOS-XR notwithstanding).

edit: A subnet mask's job is to separate host bits from network bits. The number of 1's in the subnet mask has to be contiguous.

11111111.11111111.00000000.00000000 <-- valid subnet mask (/16)
11111111.11111111.11111000.00000000 <-- valid subnet mask (/21)
11111111.11111111.00111000.00000000 <-- whoops, invalid subnet mask

Wildcard masks are not bound by this rule (hence the term "wildcard"), therefore you can do things like Aaron had mentioned, ie:

access-list 1 permit 192.168.200.0 0.6.0.8

This will permit:

192.168.200.0
192.172.200.0
192.168.200.8
192.172.200.8
| improve this answer | |
  • Alright but why can't regular subnets not address this? – Lucas Kauffman May 21 '13 at 21:53
  • 1
    A subnet mask does nothing more than to separate host bits from network bits. It must be contiguous. You do not have this restriction with wildcard masks - hence the term "wildcard." This makes them better suited for more arbitrary host or network specification. – John Jensen May 21 '13 at 21:56
  • @JohnJensen nice description of the "wildcard". Makes me remember it better :) You should put this in the original answer! – Bulki May 21 '13 at 22:37
  • I've amended my answer to include this - not sure if you meant mine or Aaron's though. – John Jensen May 21 '13 at 22:44
  • @JohnJensen I meant yours :) (just like you edited) – Bulki May 22 '13 at 5:22
2

They are somewhat a hold out from when bits were precious and processing data in certain ways (binary AND or binary OR) was less taxing.

Today, they are still useful in other cases, as Aaron has already mentioned.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.