Addressing
Wildcard mask
A mask turned inside out, as Cisco ACLs and OSPF use it: 0 bits must match, 1 bits are free.
10.0.1.16 0.0.0.15 matches 10.0.1.16 to 10.0.1.31: wildcard 15 is 0000 1111, the low four bits free. Each
byte is 255 minus the subnet mask's (0.0.0.15 ↔ 255.255.255.240, a /28; 0.0.0.255 ↔ /24), and host and any
stand for 0.0.0.0 and 255.255.255.255. Unlike a mask, a wildcard may have gaps (0.0.0.254: the even addresses).
Tools that take a mask, like iptables, read a wildcard typed in its place as the opposite.