Crazy wildcard tricks that they don’t teach you


ACL wildcards are usually used in their simplest form, e.g.  means only this address means any address from .0 to .3 means any address from .0 to .15 means any address from .64 to .95


But how should we understand a wildcard or

Let’s say we have the following acl:

deny ip any

this means that all bits in the second octet need to match with the exception of bits 6 and 7. Why? bit 6 stands for number 4, bit 7 stands for number 2.

20  in binary is 00010100. Bits that don’t need to match are bits 6 and 7.


so we could have four possible combinations:

00010000             = 16

00010010          = 18

00010100           = 20

00010110        =  22


So now we know that would match,,,

This could be used to e.g. define odd numbers. An odd number has 1 in the eighth bit, so:

xxxxxxx1  = last bit needs to match, previous don’t need to match

so while normally we define wildcards like:,, in this example it will be the opposite because it is the last bit that needs to match!

If our task is to define a range from – but only odd numbers, we would have: with the wildcard


I’ve even found a useful app for this!




Wprowadź swoje dane lub kliknij jedną z tych ikon, aby się zalogować:


Komentujesz korzystając z konta Wyloguj /  Zmień )

Zdjęcie z Twittera

Komentujesz korzystając z konta Twitter. Wyloguj /  Zmień )

Zdjęcie na Facebooku

Komentujesz korzystając z konta Facebook. Wyloguj /  Zmień )

Połączenie z %s

%d blogerów lubi to: