Wildcard Mask Cheat Sheet

Wildcards for every common prefix, with the ACL and OSPF lines you actually type on a Cisco box.

Download PDF (A4) Free to print and share in classrooms. No email needed.

Wildcard Mask Cheat Sheet

Prefix → wildcard

CIDR	Subnet mask	Wildcard
/16	255.255.0.0	0.0.255.255
/17	255.255.128.0	0.0.127.255
/18	255.255.192.0	0.0.63.255
/19	255.255.224.0	0.0.31.255
/20	255.255.240.0	0.0.15.255
/21	255.255.248.0	0.0.7.255
/22	255.255.252.0	0.0.3.255
/23	255.255.254.0	0.0.1.255
/24	255.255.255.0	0.0.0.255
/25	255.255.255.128	0.0.0.127
/26	255.255.255.192	0.0.0.63
/27	255.255.255.224	0.0.0.31
/28	255.255.255.240	0.0.0.15
/29	255.255.255.248	0.0.0.7
/30	255.255.255.252	0.0.0.3
/31	255.255.255.254	0.0.0.1
/32	255.255.255.255	0.0.0.0

The trick wildcard = 255 − mask, octet by octet
255.255.248.0 → 0.0.7.255
(or: block size − 1)

Worked example

Permit 10.1.8.0/21 in an ACL:

1/21 → mask 255.255.248.0

2255 − 248 = 7 · 255 − 0 = 255

3wildcard 0.0.7.255

permit ip 10.1.8.0 0.0.7.255 any

matches 10.1.8.0 → 10.1.15.255

Shortcuts

host 10.0.0.5 = 10.0.0.5 0.0.0.0

any = 0.0.0.0 255.255.255.255

/30 link = x.x.x.x 0.0.0.3

OSPF

router ospf 1

network 10.0.12.0 0.0.0.255 area 0

wildcard here too, not the mask!

Odd one out 0.0.0.254 → only even hosts
(non-contiguous: ACLs only)

0 = must match · 1 = don't care ✎subnetcalculator.dev

Common wildcard mistakes

Typing the subnet mask in an ACL. permit 10.0.0.0 255.255.255.0 means "first octet any, last octet must be 0" — almost never what you wanted.
Off by one. The wildcard for a block of 8 is 7, not 8. Think "block size − 1".
Network address not on the boundary. 10.1.9.0 0.0.7.255 still matches 10.1.8.0/21 because IOS ignores the "don't care" bits — but it looks like a different network to whoever reads the config next.

FAQ

What is the difference between a subnet mask and a wildcard mask?

A subnet mask marks network bits with 1s. A wildcard mask is the opposite: 0 means 'this bit must match' and 1 means 'any value'. For contiguous masks, the wildcard is simply 255 minus each octet of the subnet mask.

Where are wildcard masks used?

Mainly in Cisco IOS: standard and extended access lists, OSPF and EIGRP network statements, and some route maps. Most other platforms (Juniper, Linux, cloud security groups) use CIDR prefixes instead.

Can a wildcard mask be non-contiguous?

Yes, in Cisco ACLs. For example 0.0.0.254 matches every even address in a /24, because only the last bit must match 0. They are rarely needed and easy to get wrong, so use them only when a prefix can't express the rule.

Convert any value with the wildcard mask calculator. More sheets: subnet · IPv6 · Practise in the trainer (Mask ↔ prefix mode).