Here is a quick lesson on Cisco access lists and one of the most common mistakes made by individuals configuring them for a non standard mask boundary. I've seen this mistake made over and over again which is unfortunate because a supposedly secure environment is usually left wide open for attack. Lets take a simple example.
Lets take a more complicated example.
The mask supplied to an access list indicates which bits are significant. If the mask contains a 0 bit, that bit must be checked in the address in question. If the mask contains a 1 bit, that bit is a wildcard and is NOT checked. 248 Bin 00000000.00000000.00000000.11111000 indicates that the upper five bits in the last octet are wildcards and are NOT to be checked. Lets compute an example now.