Here is a quick lesson on Cisco access lists and one of the most common mistakes made by individuals configuring them for a non standard mask boundary. I've seen this mistake made over and over again which is unfortunate because a supposedly secure environment is usually left wide open for attack.
Lets take a simple example.
Lets take a more complicated example. The mask supplied to an access list indicates which bits are significant. If the mask contains a 0 bit, that bit must be checked in the address in question. If the mask contains a 1 bit, that bit is a wildcard and is NOT checked. 248 Bin 00000000.00000000.00000000.11111000 indicates that the upper five bits in the last octet are wildcards and are NOT to be checked.