Wildcard Mask Calculator

A wildcard mask is the inverse (bitwise NOT) of a subnet mask. It's used in Cisco IOS access control lists (ACLs) and OSPF network statements to specify which bits of an IP address must match. A 0 bit means 'must match' and a 1 bit means 'don't care'. For example, wildcard 0.0.0.255 matches any IP in a /24 network.

Subtract each octet of the subnet mask from 255. For example: subnet mask 255.255.255.0 becomes wildcard 0.0.0.255 (255-255=0, 255-255=0, 255-255=0, 255-0=255). Our calculator does this instantly for any mask.

Wildcard masks are primarily used in Cisco IOS for: 1) Standard and Extended ACLs (access-list commands), 2) OSPF network statements (router ospf), 3) EIGRP network statements, and 4) BGP network advertisements. They define which IP addresses a rule applies to.

The wildcard mask for /24 is 0.0.0.255. The subnet mask 255.255.255.0 inverted gives 0.0.0.255, meaning the first 24 bits must match exactly and the last 8 bits can be anything (256 addresses).

A subnet mask uses 1-bits to mark the network portion and 0-bits for the host portion (e.g., 255.255.255.0). A wildcard mask is the exact inverse: 0-bits mean 'must match' and 1-bits mean 'any value' (e.g., 0.0.0.255). They convey the same information but are used in different contexts.

Technically yes, Cisco supports non-contiguous wildcard masks (e.g., 0.0.0.254 to match only even IPs), but this is rarely used and considered bad practice. Our calculator focuses on standard contiguous wildcard masks that correspond to valid CIDR prefixes.