Wildcard Mask odd/even matching - a step further - 2 questions

[mmanthe]

I know the whole wildcard mask odd/even matching thing has been discussed and the info is out there for the finding. But as I was digging a little deeper, I came up with a couple of questions I could not find satisfactory answers for. This is really just a mental exercise, but I'm hoping someone out there knows:

1. Can odd/even matching be extended (at the bit level) to 'weirder' levels? For example, if for some really weird, deep-state, tin-foil hat reason you wanted to match only addresses from the 192.168.10.0/24 subnet whose last 2 (least significant) bits were 0 (e.g. every 4th useable IP address)...

In which: 

The wildcard mask would be 0.0.0.252 (252 = 11111100)

Such that:

The ACL would be:

access-list 1 perit 192.168.10.0 0.0.0.252

Would this work the way I'm thinking it would?

2. When using this 'trick' to match on addresses or subnets, does it start from the address or subnet you specify and go up?

For example - if I wanted to match all EVEN addresses from the 192.168.10.0/24 network, and I created the following:

access-list 1 permit 192.168.10.0 0.0.0.254

it would match 192.168.10.2, 192.168.10.4, 192.168.10.6...and so on through .254

BUT, if I were to create:

access-list 1 permit 192.168.10.28 0.0.0.254

would it start from 192.168.10.28 and go to 192.168.10.30, 192.168.10.32...etc, up to .254?

Thanks in advance!

[Jon Marshall · Accepted solution]

1) Yes to what you say. 

2) My first instinct was it would match every even subnet in the 192.168.10.0/24 network but wasn't sure so I did a quick lab and it does indeed match every even subnet starting at 192.168.10.2.

Jon

[mmanthe]

Outstanding! Thanks you.

[Joseph W. Doherty]

Yes, because "under-the-covers" you're doing boolean algebra, i.e. masking is done with a boolean "and". Once you understand that, you could do some really odd looking ACLs, such as network and host portions of an IP address "intermixed", or groups of hosts in "jumps", as you're doing (although only "even/odd" - the last bit).