HP 6120G/XG HP ProCurve Series 6120 Blade Switches Access Security Guide - Page 354

IPv4 Access Control Lists (ACLs) Traffic Management and Improved Network Performance Example of How the Mask Bit Settings Define a Match . Assume an ACE where the second octet of the mask for an SA is 7 (the rightmost three bits are "on", or "1") and the second octet of the corresponding SA in the ACE is 31 (the rightmost five bits). In this case, a match occurs when the second octet of the SA in a packet being filtered has a value in the range of 24 to 31. Refer to table 9-3, below. Table 9-3. Example of How the Mask Defines a Match Location of Octet Bit Position in the Octet 128 64 32 16 8 4 2 1 SA in ACE 0 0 0 1 1 1 1 1 Mask for SA 0 0 0 0 0 1 1 1 Corresponding Octet of a Packet's 0 0 0 1 1 0/1 0/1 0/1 SA The shaded area indicates bits in the packet that must exactly match the bits in the source IP in the ACE. Wherever the mask bits are ones (wildcards), the IP bits in the packet can be any value, and where the mask bits are zeros, the IP bits in the packet must be the same as the IP bits in the ACE. Note: This example covers only one octet of an IP address. An actual ACE applies this method to all four octets of an IP address. Example of Allowing Only One IP Address ("Host" Option). Sup­ pose, for example, that you have configured the ACL in figure 9-7 to filter inbound packets on port 20. Because the mask is all zeros, the ACE policy dictates that a match occurs only when the source IP address on such packets is identical to the IP address configured in the ACE. 9-30