# How to create Complex Wildcard Masks

**URL:** https://forum.networklessons.com/t/how-to-create-complex-wildcard-masks/1103
**Category:** Lessons Discussion
**Created:** [December 26, 2016, 10:53pm UTC](https://forum.networklessons.com/t/how-to-create-complex-wildcard-masks/1103 "2016-12-26T22:53:22Z")
**Posts on this page:** 1
**Showing post:** 18

<div class="post-metadata">

### Author: ![andrew](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/andrew/32/645_2.png) [@andrew](https://forum.networklessons.com/u/andrew)
#### Post date: [February 11, 2016, 12:08am UTC](https://forum.networklessons.com/t/how-to-create-complex-wildcard-masks/1103/18 "2016-02-11T00:08:35Z")

</div>

I must be slow today. I have read over your analysis many times, but I am still not understanding this. Let’s continue to use your range of 10 addresses for the example.

If I take the entire set of 10. addresses, and run them through the ACL\_ODDEVEN filter, just one is left:  
10.1.0.1

If I take the entire set of 10. addresses, and run them through the ACL\_COMBO filter, a total of four is left (which is what you found above):  
10.0.0.1  
10.1.0.1 \<------ Also the result of ACL\_ODDEVEN  
10.1.1.1  
10.2.0.1

If we look at the results of the ACL\_COMBO in binary (just the 2nd and 3rd octet):  
0000000 **0** 00000000 \<------ This should have been filtered  
00000001 00000000 \<------ Correct, also the result of ACL\_ODDEVEN  
00000001 0000000 **1** \<------ This should have been filtered  
0000001 **0** 00000000 \<------ This should have been filtered

I have bolded the bits that would have caused the set of numbers above to have failed ACL\_ODDEVEN. The question is why isn’t ACL\_COMBO also failing these? Is there some kind of logic change between these?  
#1 (ACL\_ALLOWODDEVEN, essentially)

* * *

deny 0.0.0.0 255.254.255.255  
deny 0.0.1.0 255.255.254.255

* * *

#2 (ACL\_Combo, essentially)

* * *

deny 0.0.1.0 255.254.254.255

* * *

#1 looks for an exact match of the least significant bit of the 2nd octet for the first line, then  
looks for an exact match of the least significant bit of the 3rd octet for the second line.

#2 looks for an exact match of the least significant bit of both the 2nd and 3rd octet.

So in both cases, an exact value is being matched on in the second and third octet. The difference is #1 does it in two statements, while #2 does it in one statement.

In the lab, these two behave differently.

---

_[View the full topic](https://forum.networklessons.com/t/how-to-create-complex-wildcard-masks/1103)._