If a 0 bit appears in the mask, then the corresponding bit location in the access list address and the packet address must match for the access list condition to apply.

If a 1 bit appears in the mask, then the corresponding bit in the packet address is ignored. This part of the source address plays no part in deciding whether to apply access list conditions. For this reason, 1 bits in the mask are sometimes called "don't care" bits.


Example address	    Mask		Matches

0.0.0.0		    255.255.255.255	any address

172.16.0.0		    0.0.255.255	network 
				172.16.0.0

172.16.67.0	    0.0.0.255	only subnet 
				172.16.67.0

172.16.67.2	    0.0.0.0		exactly host 
				172.16.67.2

255.255.255.255	    0.0.0.0		local broadcast
@@
