Necessary cookies and storage support sign-in and learning. Optional Vercel analytics and campaign measurement stay off unless you accept. Rejecting won't affect courses or checkout.
Global Privacy Control is on. Optional analytics stays off.
FREE TOOL
Paste a Cisco IOS XE IPv4 access list and describe one packet. The tester checks the packet against each entry in sequence order, stops at the first entry that matches, and shows which entry decided and why. When no entry matches, it shows the implicit deny at the end of the list. The test runs in this page, and the page does not send what you paste to a server. No account is required.
This tester runs in your browser and needs JavaScript turned on. The boxes stay locked until the page script loads, so the page cannot send anything you enter. If they stay locked, the script did not load. Turn on JavaScript or reload the page to use the tester.
The tester is ready. It runs in this page, and the page does not send what you enter to a server.
One row for each entry of the list, with what the tester found. Entries after the one that decides are not checked, as on the router.
| Line | Seq | Entry | Result |
|---|
Each step shows the 32 bits in binary and dotted decimal. Network bits are shown in bold and host bits in normal weight where a prefix applies.
The router compares a packet with the entries of an access list in sequence order. The first entry that matches decides: a permit entry lets the packet through and a deny entry drops it, and the router checks no further entries. Every access list ends with a deny that the configuration does not show. If the packet matches none of the entries, that implicit deny drops it. A list with only deny entries therefore drops everything, and a list that should allow other traffic ends with a permit.
A standard list, numbered 1 to 99 or 1300 to 1999 or created with "ip access-list standard", tests the source address only. An extended list, numbered 100 to 199 or 2000 to 2699 or created with "ip access-list extended", tests the protocol, the source and destination addresses, and the ports and flags the entry names.
An address in an entry comes with a wildcard. A 0 bit in the wildcard means the packet's bit must equal the entry's bit, and a 1 bit means the bit is ignored. The keyword host stands for a wildcard of 0.0.0.0, one exact address, and any stands for 255.255.255.255, every address. A wildcard does not have to be a run of zeros followed by ones. In "permit ip 10.1.0.0 0.0.254.255 any" the third octet of the wildcard is 254, so the lowest bit of the third octet must be 0 and every other bit there is ignored. The entry matches 10.1.x.y only when x is even.
To practice, decide on paper whether 10.1.2.5 and 10.1.3.5 match that entry. Then paste the example list below, which holds four entries of a list captured from a lab router, test a tcp packet from each address with the ACK or RST box clear, and compare the wildcard working with your answer.
ip access-list extended 110
10 permit ospf any any
40 permit tcp any any established
80 permit ip 10.1.0.0 0.0.254.255 any
100 deny ip any any logA wildcard written like a subnet mask is still a wildcard. The router reads "10.0.0.0 255.0.0.0" as "ignore the first octet and match 0.0.0 in the last three", not as 10.0.0.0/8. The tester evaluates it the same way and adds a note when it sees one.
"established" applies to TCP entries only. It matches a segment that has the ACK bit or the RST bit set, which every segment of a connection has except the first SYN that opens it. An entry such as "permit tcp any any established" therefore admits replies to connections opened from the inside and refuses new connections opened from the outside. Tick the ACK or RST box to describe a reply.
The tester reads the forms captured from IOS XE 17.12.1 and the operators Cisco documents beside them. Lists: running-config "ip access-list standard" and "ip access-list extended" blocks with sequence numbers, "show access-lists" output with its match counters, and "access-list" commands. Addresses: any, host, an address with a wildcard, and the standard list's "address, wildcard bits" form. Protocols: ip, tcp, udp, icmp and ospf. Ports: eq, gt, lt, neq and range, as numbers or the names www, telnet and domain. ICMP messages: echo and echo-reply. Flags: established and log.
An entry that uses anything else, such as an object group, a time range, a reflexive or dynamic entry, DSCP, precedence, TTL, fragments, TCP flag keywords, another protocol or another ICMP message name, is marked unsupported. If the packet reaches such an entry before a match, the tester gives no permit or deny, because that entry might match. An entry that is malformed, such as an address with a number above 255, is refused with its line number.
The result depends on the whole access list you pasted, and an access list is device configuration. This page never writes configuration or device output to a link, so the tester has no share link and never writes the list or the packet to the page's URL. Use Copy results to keep a record of a test.
The tester tests one IPv4 packet against one list. It does not know where the list is applied, so it cannot say whether a packet reaches the list at all: that depends on the interface, the direction, and any other list or feature on the path. It treats the packet as unfragmented and does not model how IOS matches fragments. It reads only the documented subset above. The forms it reads were captured from Cisco IOS XE 17.12.1 running as IOL on Cisco Modeling Labs; other releases and platforms can print the same list differently. The working shows the first 8entries that did not match, the entry that decides and its wildcard working, and the table lists every entry.
Sources: Cisco IP access list overview, for first match, the implicit deny, wildcard bits and standard lists; Cisco IOS permit command reference (IOS 11.2 and later), for the port operators, established, any and host. That reference documents IOS 11.2-era syntax; the IOS XE 17.12.1 output captured for this page uses the same keywords. The IANA port number registry, for www (80), telnet (23) and domain (53); RFC 792, for echo (type 8) and echo reply (type 0).