Wildcard Mask Calculator

Frequently Asked Questions

What is a wildcard mask?

The bitwise inverse of a subnet mask (255.255.255.255 − mask), used in Cisco ACLs and OSPF. A /24 mask 255.255.255.0 becomes wildcard 0.0.0.255 - 0 bits must match, 1 bits are "don't care".

How is it different from a subnet mask?

A subnet mask defines network vs host for addressing; a wildcard mask defines which address bits a rule must match. This tool focuses on the ACL/OSPF use, not subnet design.

Can wildcard masks be non-contiguous?

Yes - unlike subnet masks, wildcards can match patterns like all odd hosts or every fourth subnet (e.g., 0.0.0.254), which the calculator can illustrate.

What address range does an ACL line cover?

The base address combined with the wildcard. 10.0.0.0 with 0.0.0.255 matches 10.0.0.0–10.0.0.255; the tool shows the resulting range and example syntax.

Provided by AllCalculators.io
Free online calculators for everyday. No registration required.

Estimates for informational purposes only.

Important Disclaimer: Estimates for informational purposes only.

This calculator provides estimates for informational purposes only. Results are based on assumptions and may not reflect actual outcomes. Consult qualified professionals in relevant fields before making important decisions based on these results.

JavaScript is required to use the interactive calculator above. The questions and answers below remain readable without JavaScript.

How This Calculator Works

A wildcard mask is the bitwise inverse of a subnet mask: wildcard = 255.255.255.255 − subnet mask, computed per octet (or as a bit-flip of every mask bit). Where a subnet mask uses a 1 to mean "this bit must match," a wildcard uses a 0 for "must match" and a 1 for "don't care." Cisco ACLs and OSPF network statements consume wildcards, not subnet masks. This tool accepts either a dotted mask or a CIDR length, inverts it, derives the equivalent prefix, and - given a base address - shows the exact address range a single ACL line would match.

Worked Example

Subnet mask 255.255.255.0 (/24) inverts to wildcard 0.0.0.255: the first three octets must match, the last is "don't care." With base 192.168.10.0 the line access-list 10 permit 192.168.10.0 0.0.0.255 matches every host 192.168.10.0 through 192.168.10.255. For a single host use wildcard 0.0.0.0 (or the keyword host); to match everything use 0.0.0.0 255.255.255.255 (the keyword any). Each 1 bit in the wildcard doubles the number of addresses the rule covers.

Non-Contiguous "Odd/Even" Wildcards

Unlike subnet masks, wildcard bits need not be contiguous - this is their hidden power. The wildcard 0.0.0.254 (binary 11111110 in the last octet) ignores every bit except the lowest, so 10.0.0.0 0.0.0.254 matches only even last-octet addresses; 10.0.0.1 0.0.0.254 matches only odd ones. Similarly 0.0.0.15 matches a /28-sized block while 0.0.15.255 spans 16 consecutive /24s. These patterns let one ACL line express filters no subnet mask could ever represent.

Common Mistakes

Pasting a subnet mask where a wildcard is expected:255.255.255.0 in an ACL matches almost nothing - you wanted 0.0.0.255.

Forgetting the implicit deny: every Cisco ACL ends with an invisible deny any; if nothing matches, traffic is dropped.

Wrong base address: the address paired with the wildcard should be the network's zero-host base, not an arbitrary host inside it.

Assuming order doesn't matter: ACLs are evaluated top-down and stop at the first match - specific rules must precede broad ones.

How This Differs From a Subnet Mask Tool

This calculator is intentionally distinct from the Subnet / CIDR tool. That one answers "what network, broadcast and host range does this address belong to?" This one answers an access-control question: "which wildcard expresses the set of addresses I want a router to act on, and what range will an ACL or OSPF statement actually match?" The focus here is the bitwise inverse, ready-to-paste access-list and OSPF network syntax, and the non-contiguous matching that subnet masks cannot do at all.

Frequently Asked Questions

Related Networking & IT Calculators