be 0.0.0.31. Luckily, there is a trick to figuring out all wildcard masks, and it's easier than you might think. Here it is: The wildcard mask will be a derivative of the number of host addresses provided by the subnet mask minus one. In the preceding example (the subnet mask 255.255.255.224), there are eight net- works with 32 hosts in each (see Chapter 34 for help figuring out how many hosts are in a subnetted network). 32 - 1 = 31. The wildcard mask is 0.0.0.31. Yes, it's really that simple. All you really need to think about is the one octet that isn't a 0 or a 255. In the case of the wildcard mask being in a position other than the last octet, simply use the same formula, and consider the number of hosts to be what it would be if the divid- ing octet were the last octet. Here's an example, using the subnet mask 255.240.0.0: 1. 240 in the last octet of a subnet mask (255.255.255.240) would yield 16 hosts. 2. 16 - 1 = 15. 3. The wildcard mask is 0.15.255.255. The more you practice subnetting in your head, the easier this becomes. Try a few for yourself, and you'll quickly see how easy it is. Where to Apply Access Lists One of the most common questions I hear from junior engineers is, "Do I apply the access list inbound or outbound?" The answer is almost always inbound. Figure 23-1 shows a simple router with two interfaces, E0 and E1. I've labeled the points where an access list could be applied. The thing to remember is that these terms are from the viewpoint of the device. Chapter 23: Access Lists Interface Interface Figure 23-1. Access-list application points Usually, when you're trying to filter traffic, you want to prevent it from getting into the network, or even getting to the device in the first place. Applying access lists the inbound side of an interface keeps the packets from entering the device, thus sav- ing processing time. When a packet is allowed into a device, and then switched to another interface, only to be dropped by an outbound filter, resources used to switch the packet have been wasted. 