An inverse mask is a bitwise comparison which allows you to block patterns of IP addresses based on the reverse mask.
Unlike a subnet mask, where you are confined to n² rule and the binary bits have to be all 1's on one side and 0's on the other, an inverse mask can be any whole number between 0 and 255.
Example: 192.168.23.53 inverse mask 0.0.0.255
when converted to binary is IP 11000000.10101000.00010111.00110101 mask 00000000.00000000.00000000.11111111
In binary because it is a reverse mask, where the mask contains a 0, the bits of the IP address compared against the ACL have to match. Conversly, anywhere the mask contains a 1 doesn’t have to match.
Consider 192.168.23.53 inverse mask 0.0.0.10:
Now in binary it looks like IP 1100000.10101000.00010111.00110101 Mask 00000000.00000000.00000000.00001010
11000000.10101000.00010111.00110101 IP
00000000.00000000.00000000.00001010 Mask
Effectively you get the below sequence. Where there is an X you can put a 1 or a 0 and it is still a match for the rule.
11000000.10101000.00010111.0011X1X1
There are four valid matches for this rule.
1100000.10101000.00010111.0011X1X1
-----------------------------------------------------------------
1100000.10101000.00010111.00110101 192.168.23.53
1100000.10101000.00010111.00111101 192.168.23.61
1100000.10101000.00010111.00110111 192.168.23.55
1100000.10101000.00010111.00111111 192.168.23.63
All match the mask of 0.0.0.10