ACE processing compares the packet header information to a matching rule in the ACE. The rules that define matching of IPv4 addresses are written using wildcard masks. As with subnet mask and an IPv4 address, a wildcard mask is a string of 32 binary digits. However, a wildcard mask is used by a device to determine which bits of the address to examine for a match.
ACE 處理過程會將封包標頭資訊與 ACE 中的比對規則進行比較。定義 IPv4 位址比對方式的規則，是以萬用字元遮罩（wildcard mask）撰寫的。與子網路遮罩及 IPv4 位址相同，萬用字元遮罩也是一串 32 個二進位數字。然而，萬用字元遮罩是裝置用來判斷應檢查位址哪些位元以進行比對之用。
A wildcard mask is not used on its own. It is used in conjunction with an IPv4 address. The matching rule consists of a reference IPv4 address and a wildcard mask that applies to it. When a wildcard mask is applied to the reference IPv4 address, the result is the matching pattern of binary digits. For a match to occur, the IPv4 address from the packet header must match the resulting pattern.
萬用字元遮罩不會單獨使用，而是與 IPv4 位址搭配使用。比對規則由一個參考 IPv4 位址以及適用於它的萬用字元遮罩所組成。當萬用字元遮罩套用到參考 IPv4 位址時，結果就是比對用的二進位數字樣式。若要成功比對，來自封包標頭的 IPv4 位址必須符合該結果樣式。
When a wildcard mask is applied, the following rules are in place:
套用萬用字元遮罩時，適用以下規則：
- Where a wildcard mask bit is 0: the value found at the same position in the "reference" IPv4 address must be matched.當萬用字元遮罩位元為 0 時：必須比對「參考」IPv4 位址中相同位置的值。
- Where a wildcard mask bit is 1: the value found at the same position in the "reference" IPv4 address can be ignored.當萬用字元遮罩位元為 1 時：可以忽略「參考」IPv4 位址中相同位置的值。
Matching criteria/matching rule has two elements:
比對標準／比對規則有兩個要素：
- IPv4 address provides a reference against which IPv4 packet information is evaluated.IPv4 位址提供了一個參考基準，IPv4 封包資訊會依此進行評估。
- Wildcard mask provides evaluation criteria:萬用字元遮罩提供評估標準：
- 0 = this bit must match the value in the reference IPv4 address0 = 這個位元必須符合參考 IPv4 位址中的值
- 1 = this bit can have whatever value1 = 這個位元可以是任何值
When comparing an IPv4 address from the packet header with the reference address from the ACL statement, a device is looking for a match only for those bits of the reference IPv4 address that are masked by 0s in the wildcard mask.
當裝置將封包標頭中的 IPv4 位址與 ACL 陳述式中的參考位址進行比較時，只會針對參考 IPv4 位址中被萬用字元遮罩以 0 遮蓋的那些位元尋找比對。
The example demonstrates how the wildcard mask is interpreted. The reference IPv4 address is 172.16.100.1. For clarity, the analysis is given only for the third octet. The second column lists some possible values for a wildcard mask octet, from 0000 0000 to 1111 1111. The third column contains the reference octet value 100 decimal, presented in its binary form. Where the wildcard mask has a 0, the binary digit is colored red to indicate that the digit must match with the same digit in the analyzed packet. Where the wildcard mask has a 1, the binary digit is green, to indicate that the digit can be of any value. For each wildcard mask - reference value combination, the fourth column gives the resulting matching pattern. The "" character indicates a bit of whatever value. The final column gives the decimal values that would match the criteria specified with the reference value and the wildcard mask.
此範例示範如何解讀萬用字元遮罩。參考 IPv4 位址為 172.16.100.1。為求清楚，這裡僅針對第三個八位元組進行分析。第二欄列出了萬用字元遮罩八位元組的一些可能值，從 0000 0000 到 1111 1111。第三欄則以二進位形式呈現參考八位元組的十進位值 100。當萬用字元遮罩該位元為 0 時，該二進位數字以紅色標示，表示該位元必須與被分析封包中相同的位元相符；當萬用字元遮罩該位元為 1 時，該二進位數字以綠色標示，表示該位元可以是任何值。針對每一組萬用字元遮罩與參考值的組合，第四欄給出對應的比對樣式，「＊」字元表示該位元可為任意值。最後一欄則列出符合該參考值與萬用字元遮罩所指定條件的十進位值。
A wildcard mask is sometimes referred to as an inverse mask. In a subnet mask, binary 1 is equal to a match and binary 0 is not a match. The reverse is true for wildcard masks. A 0 in a bit position of the wildcard mask indicates that the corresponding bit in the address must be matched. A 1 in a bit position of the wildcard mask indicates that the corresponding bit in the address is not interesting and can be ignored. There is another significant difference between the subnet mask and the wildcard mask. After the first 0 in a subnet mask, all subsequent bits are 0, while the length of a subnet mask is the continued number of binary values.
萬用字元遮罩有時也稱為反向遮罩（inverse mask）。在子網路遮罩中，二進位 1 代表符合，二進位 0 代表不符合；萬用字元遮罩則正好相反。萬用字元遮罩中某個位元位置為 0，表示位址中對應的位元必須符合；為 1 則表示位址中對應的位元不重要，可以忽略。子網路遮罩與萬用字元遮罩之間還有另一個顯著差異：在子網路遮罩中，第一個 0 出現之後，後續所有位元都是 0，也就是子網路遮罩的長度是連續的二進位值數量。
There is no such regularity in wildcard masks—After the first 1 in a wildcard mask, subsequent bits can be either 0s or 1s, with no obligatory contiguity. Therefore, wildcard masks are much more flexible than the subnet masks. In other words, it is not always the case to have two parts of the wildcard mask, determined with only binary 0 and only binary 1 (for example: 0.0.255.255).
萬用字元遮罩則沒有這種規律性，第一個 1 出現之後，後續位元可以是 0 或 1 的任意組合，不需要連續。因此，萬用字元遮罩比子網路遮罩更有彈性。換句話說，萬用字元遮罩不一定要分成只由二進位 0 組成與只由二進位 1 組成的兩個部分（例如：0.0.255.255）。
The flexibility available with wildcard masks is to identify subsets, such as odd or even matches.
萬用字元遮罩的彈性可用來識別子集合，例如奇數或偶數比對。
The example illustrates different matching rules.
此範例說明了不同的比對規則。
The example illustrates different matching rules.
此範例說明了不同的比對規則。
The figure illustrates several examples of matching rules. The first two examples have different reference addresses (172.16.100.0 and 172.16.100.1), but the result in the same range of addresses because the relevant portions of the reference addresses (the first 24 bits, as indicated by the wildcard mask) are equivalent in both addresses. The third example shows a wildcard mask that does not have only continuous sequences of 0s and 1s. Note that the third octet of the 0.0.254.255 wildcard mask breaks the array of 1s (DEC 254 = BIN 11111110). This wildcard mask requires that the last bit of the third octet must match the same bit in the reference address, which is 1. Since only odd values have the last bit 1, the matching criteria requires an IPv4 address to be from one of the odd numbered /24 networks, such as 192.168.1.0, 192.168.3.0, 192.168.5.0, and so on. Consequently, if the IPv4 address contains 0 in the last bit of the third octet (like 192.168.4.1), any even value in the third octet will create a match.
圖中展示了幾個比對規則的範例。前兩個範例有不同的參考位址（172.16.100.0 與 172.16.100.1），但結果卻是同一個位址範圍，因為參考位址中的相關部分（由萬用字元遮罩指定的前 24 個位元）在兩個位址中是相同的。第三個範例展示了一個並非只由連續 0 或連續 1 組成的萬用字元遮罩。請注意，萬用字元遮罩 0.0.254.255 的第三個八位元組打破了連續 1 的排列（十進位 254 ＝ 二進位 11111110）。這個萬用字元遮罩要求第三個八位元組的最後一個位元必須符合參考位址中的相同位元，也就是 1。由於只有奇數值的最後一個位元是 1，因此比對條件要求 IPv4 位址必須來自奇數編號的 /24 網路之一，例如 192.168.1.0、192.168.3.0、192.168.5.0 等等。反之，若 IPv4 位址第三個八位元組的最後一個位元是 0（例如 192.168.4.1），則第三個八位元組的任何偶數值都會產生比對。
With wildcard masks you can define criteria for matching all bits of an IPv4 address, or you can define rules that require only parts of the reference address to match. Partial match requirement results in a range of addresses matching the criteria, such as IPv4 addresses of many subnets. By carefully setting wildcard masks, with one ACE you can select a single IPv4 address or multiple IPv4 addresses.
利用萬用字元遮罩，你可以定義要求比對 IPv4 位址全部位元的條件，也可以定義只要求比對部分參考位址的規則。部分比對的要求會使符合條件的結果變成一個位址範圍，例如許多子網路的 IPv4 位址。只要謹慎設定萬用字元遮罩，一條 ACE 就能選取單一 IPv4 位址或多個 IPv4 位址。
The figure illustrates two uses of wildcard masks: one to match only one subnet and another to match a range of subnets. Assume that you have subnetted address 172.16.0.0, and you want to create a wildcard mask that matches packets from subnets 172.16.16.0/24 through 172.16.31.0/24. There are 16 different subnets in that range. All 16 subnets have the first two octets identical. The third octet has values from 16 to 31.
圖中說明了萬用字元遮罩的兩種用法：一種只比對單一子網路，另一種比對一個子網路範圍。假設你已將位址 172.16.0.0 劃分子網路，並想建立一個萬用字元遮罩，用來比對來自子網路 172.16.16.0/24 到 172.16.31.0/24 的封包。該範圍內共有 16 個不同的子網路，這 16 個子網路的前兩個八位元組都相同，第三個八位元組的值則從 16 到 31。
To create rules that would match all 16 subnets, one way would be to create 16 different ACEs, one for each matching subnet. Each of the 16 ACE statements would include a criterion composed of the subnet ID and the wildcard mask 0.0.0.255, as illustrated in the first table in the example. However, that would unnecessarily create an ACL with 16 or more statements, when the criterion could be met with a single statement. Minimizing ACL statements optimizes ACL processing speed.
要建立能比對這 16 個子網路的規則，其中一種方法是建立 16 條不同的 ACE，每條各對應一個子網路。這 16 條 ACE 陳述式各自包含由子網路 ID 與萬用字元遮罩 0.0.0.255 組成的條件，如範例中的第一個表格所示。然而，這樣做會建立出一個有 16 條甚至更多陳述式的 ACL，而其實只用一條陳述式就能達到相同條件。精簡 ACL 陳述式可以優化 ACL 的處理速度。
To minimize the number of statements in an access list, you should try to find a wildcard mask that matches a wider range of subnets. To do so, look into the binary representations of the desired address range and identify which bits are identical in all of them. In the example for subnets 172.16.16.0/24 through 172.16.31.0/24, it is easy to see that the first two octets are identical in all addresses. Therefore, for a packet to match the range, it too must have the same first two octets equal to 172.16. The wildcard mask that requires matching the first two octets has 0s at the first 16 positions.
為了精簡存取清單中的陳述式數量，你應該嘗試找出能比對更廣範圍子網路的萬用字元遮罩。做法是檢視所需位址範圍的二進位表示法，找出所有位址中相同的位元。在 172.16.16.0/24 到 172.16.31.0/24 這個子網路範圍的範例中，很容易看出所有位址的前兩個八位元組都相同。因此，若封包要符合此範圍，它的前兩個八位元組也必須等於 172.16。要求前兩個八位元組必須相符的萬用字元遮罩，其前 16 個位置皆為 0。
The third octet can have any value from 16 to 31. If you look closer into binary representations of numbers 16 to 31, you will notice that all of them start with the same 4 bits 0001. The last 4 bits differ, from 16 having all zeros 0000, to 31 having all ones, 1111. Therefore, any packet that has an address with the third octet starting with 0001, belongs to the desired range. You can now determine the wildcard mask value. Four "must match" bits followed by 4 "whatever" bits translate to a wildcard mask octet 00001111, or 15 in decimal representation.
第三個八位元組可以是 16 到 31 之間的任何值。如果仔細觀察 16 到 31 這些數字的二進位表示法，你會發現它們都以相同的 4 個位元 0001 開頭，最後 4 個位元則不同，從 16 的全 0（0000）到 31 的全 1（1111）。因此，任何位址第三個八位元組以 0001 開頭的封包，都屬於所需範圍。你現在可以決定萬用字元遮罩的值：4 個「必須符合」位元後接 4 個「任意值」位元，換算為萬用字元遮罩八位元組 00001111，十進位表示為 15。
The last octet can have any value because you wish to select all packets from desired subnets. Therefore, the last octet of the wildcard mask is all 1s, or 255 in decimal representation. The entire wildcard mask would be 0.0.15.255.
由於你希望選取所需子網路的所有封包，因此最後一個八位元組可以是任何值。因此萬用字元遮罩的最後一個八位元組全部為 1，十進位表示為 255。整個萬用字元遮罩即為 0.0.15.255。
Now that you have the wildcard mask determined, you need to determine the reference IPv4 address and you will have the range matching rule. As the reference IPv4 address, you can select any address from the range you wish to match. Examples of matching rules would be 172.16.16.1 0.0.15.255, 172.16.17.1 0.0.15.255, or 172.16.30.200 0.0.15.255. As long as you keep the wildcard mask unchanged, all these matching rules result in the same range of matched IPv4 addresses. However, if you configure an ACL with any of these matching rules, it will be changed to be an entry that has all nonmatching bits in the reference IPv4 address set to binary 0, so you may see the configured reference IPv4 address different than you typed in. In this example, the matching rule would be changed to 172.16.16.0 0.0.15.255.
既然已經決定好萬用字元遮罩，接下來你需要決定參考 IPv4 位址，才能得到完整的範圍比對規則。做為參考 IPv4 位址，你可以選取所需範圍內的任何一個位址。比對規則的範例可以是 172.16.16.1 0.0.15.255、172.16.17.1 0.0.15.255，或 172.16.30.200 0.0.15.255。只要萬用字元遮罩保持不變，這些比對規則都會產生相同範圍的符合 IPv4 位址。然而，如果你用這些比對規則之一設定 ACL，它會被改成一個項目，其中參考 IPv4 位址中所有不參與比對的位元都會被設為二進位 0，因此你可能會看到設定好的參考 IPv4 位址與你原本輸入的不同。在本例中，比對規則會被改成 172.16.16.0 0.0.15.255。
Note that wildcard mask 0.0.15.255 matches all possible subnets that have the same 4 bits in the third octet. In the example, there are exactly 16 values that have 0001 as the first 4 bits. You were looking for one statement to match exactly 16 subnets—no more or less. You will not always be able to find a perfect fit with just one ACL statement. For instance, if you had to match subnets 172.16.16.0 to 172.16.27.0 (only 12 subnets), the same matching rule 172.16.16.0 0.0.15.255 would include the desired 12 subnets, but it would be too wide because it would also include subnets 172.16.28.0 to 172.16.31.0.
請注意，萬用字元遮罩 0.0.15.255 會比對所有第三個八位元組前 4 個位元相同（皆為 0001）的可能子網路。在此範例中，恰好有 16 個值的前 4 個位元為 0001。你原本正是要找出一條能精準比對這 16 個子網路（不多不少）的陳述式。但你不一定總能只靠一條 ACL 陳述式找到完美吻合的結果。例如，若你要比對的是子網路 172.16.16.0 到 172.16.27.0（只有 12 個子網路），使用相同的比對規則 172.16.16.0 0.0.15.255 雖然會涵蓋所需的 12 個子網路，但範圍會過寬，因為它也會包含子網路 172.16.28.0 到 172.16.31.0。
To match the desired range of addresses exactly, sometimes you will have to use more than one ACL statement. For example, to match a range of addresses from 172.16.16.0/24 to 172.16.32.0/24, you should use two entries with the following matching rules: 172.16.16.0 0.0.15.255 and 172.16.32.0 0.0.0.255.
有時為了精確比對所需的位址範圍，你必須使用一條以上的 ACL 陳述式。例如，要比對從 172.16.16.0/24 到 172.16.32.0/24 的位址範圍，你應該使用以下兩條比對規則：172.16.16.0 0.0.15.255 與 172.16.32.0 0.0.0.255。