Wildcard mask question.

[polm]

Given the address 192.168.255.3 and the wildcard mask 0.0.0.252, which of the following addresses woould be a match ? (choose all that apply.)

a. 192.168.255.3

b. 192.166.255.7

c. 192.168.255.19

d. 192.168.255.255

e. 192.168.252.51

 

[n0cmonkey]

http://tcpmag.com/qanda/article.asp?EditorialsID=291

 

[spidey07]

first three octects must match (zeros)

last portion of mask is 11111100. combine that with the three (00000011) and you see that the last two bits must be ones.

So any number with the last two bits are ones will match and first three octets of 192.168.255.

 

[polm]

Originally posted by: n0cmonkey
http://tcpmag.com/qanda/article.asp?EditorialsID=291

wow, I could not have asked for a better reply. Thanks!

 

[spidey07]

Originally posted by: polm

Originally posted by: n0cmonkey
http://tcpmag.com/qanda/article.asp?EditorialsID=291

wow, I could not have asked for a better reply. Thanks!

fine, I didn't want to play anyway.

 

[polm]

Just to explain my confusion.

I am pretty comfortable doing subnet mask/range calculations. I have always thought of wildcard masks as a simple reversal of the subnet procedure.

Well.. the question seemed to me to be asking for a range. I figured that I could just reverse the wildcard mask to get the subnet mask. Then do my standard range calculation. I guessed that my allowable IPs would be within this range. So:

0.0.0.252 became 255.255.255.3

This left a host range of 6 bits. That would be 2^6 = 64. So I figured my range had to be in blocks of 64 (minus 2 of course) . So I guessed A and C, but left off D because it didn't fit in the 64 block range that A and C did.

I guess the wildcard masks don't work that way.

 

[n0cmonkey]

Originally posted by: spidey07

Originally posted by: polm

Originally posted by: n0cmonkey
http://tcpmag.com/qanda/article.asp?EditorialsID=291

wow, I could not have asked for a better reply. Thanks!

fine, I didn't want to play anyway.

If it makes you feel better, I didn't read the article but I read your post.

 

[spidey07]

wild card masks are a little different. Sure they are just the reverse, but the book throws tricks at you like this one to make sure you understand.

Mask generally is 255.255.192.0
wildcard mask would be 0.0.63.255.

Notice the difference, wildcard masks generally start from the least most significant bit and move left to describe a match. Where as masks usuall start with the MSB and work right.

But it doesn't have to work that way - you could have a subnet mask of 255.255.255.75. Now you don't have a range of IP addresses, just a messed up mask. But it would work.

 

[polm]

so basically, when things don't line up to the normal boundaries I will need to do the calculations with longhand binary.

can you break your example down for me ?

What IP's would match 255.255.255.75 ?

75 = 01001011

So the 1's have to match from mask to IP, and the 0's can be whatever. Right ?

 

[ScottMac]

In order to gain the benefits of using a wildcard mask, the mask bits in the octet of distinction shold be contiguous.

Doing so allows you to address a block or range of interesting items with a single statement, saving processing cycles, time, and memory resources.

One of the more common examples is the blocking of RFC1918 addresses at the choke router:

The 10.0.0.0 address is easy (0.255.255.255). The 192.168.X.0 addresses are easy (0.0.255.255). The range of Class B addresses is where it comes in handy ...

Access-list 101 deny ip 172.16.0.0 0.15.255.255 any (applied to the inbound interface)

172.16.0.0 is the root address. "172" is matched exactly (the Zero). The "15" (which is the four low-order bits set to one) will match the next 15 networks (from 172.17.0.0 - 172.31.0.0). A simple, single access-list line will save a great deal of processor time and memory. Remember, every packet must be compared to an access-list and evalulated. The more lines it must compare, the longer it takes and the more processor cycles will be consumed.

If we had to match up to 172.32.0.0, an additional access-list line would be needed, becasue the root bit pattern would be changed (00100000 versus 00010000 - ranging up to 00011111 with the wildcard mask).

As soon as the bit pattern changes for the root, another line would be needed (possibly another block definition if the addresses allow it).

THIS is why planning an IP address schema is so important. Done properly it allows summarization ... which saves processor time and (in the case of routing protocols) bandwidth.

Hopefully this helps ....

FWIW

Scott

 

[msal]

A

 

[spidey07]

Originally posted by: msal
A

Alpha?