Wildcard mask calculator

How to use the Wildcard Mask Calculator tool

1. Type a mask (255.255.255.0), a wildcard (0.0.0.255) or a prefix (/24).
2. Optionally enter the network address to get ACL and routing examples.
3. Copy the line you need into your configuration.

What a wildcard mask is

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask has 1s for the network part, the wildcard has 0s, meaning “this bit must match”, and 1s meaning “this bit can be anything”. The quick way to compute it: subtract each octet of the subnet mask from 255. So 255.255.255.0 becomes 0.0.0.255, and 255.255.255.224 becomes 0.0.0.31.

Cisco IOS uses wildcard masks in access control lists and in the network statements of OSPF and EIGRP. Getting one wrong is a classic mistake: writing 255.255.255.0 where a wildcard is expected means “match anything in the first three octets and only .0 in the last”, which is almost never what you want.

Non-contiguous wildcards

Unlike subnet masks, wildcards do not have to be a continuous run of bits. A wildcard of 0.0.254.255 matches every even third octet, which can select, for example, all even-numbered VLAN subnets with one ACL line. The calculator recognises such masks and shows their binary form. They are powerful but hard to read, so document them well.

Tips from network practice

• Use host 10.1.1.1 instead of 10.1.1.1 0.0.0.0: it is the same thing and easier to read.
• In OSPF, the wildcard in the network statement only selects interfaces. It does not change the mask that is advertised.
• Remember the implicit “deny any” at the end of every ACL.
• Newer platforms (IOS XE named ACLs, NX-OS, ASA) often accept prefix notation; check before converting.

Privacy

Everything runs in your browser. Nothing you type is sent to our server or stored.

Frequently asked questions