What is a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask has a 1-bit (network bit), the wildcard mask has a 0-bit (must match). Where the subnet mask has a 0-bit (host bit), the wildcard mask has a 1-bit (any value allowed). For example, the wildcard mask for 255.255.255.0 (/24) is 0.0.0.255.

How is a wildcard mask different from a subnet mask?

A subnet mask marks which bits are the network portion (1s) and which are the host portion (0s). A wildcard mask reverses this — 0 means the bit must match exactly, and 1 means the bit is ignored. Cisco devices use wildcard masks in ACLs and OSPF because they allow more flexible matching patterns than subnet masks.

How do I use a wildcard mask in a Cisco ACL?

In a Cisco ACL, you pair an IP address with a wildcard mask: "permit ip 192.168.1.0 0.0.0.255 any" permits all traffic from the 192.168.1.0/24 network. The wildcard mask 0.0.0.255 means the first three octets must match exactly, and the last octet can be anything.

What wildcard mask do I use to match a single host?

Use 0.0.0.0 as the wildcard mask (or the keyword "host" on Cisco IOS). This means every bit must match exactly, so only that single IP address is matched.

What wildcard mask matches any IP address?

Use 255.255.255.255 as the wildcard mask (or the keyword "any" on Cisco IOS). All bits are ignored, so every IP address matches.

Can wildcard masks be non-contiguous?

Yes. Unlike subnet masks which must have contiguous 1-bits, wildcard masks can have any bit pattern. For example, 0.0.0.254 matches every even IP address in a subnet. This calculator focuses on standard contiguous masks derived from CIDR prefixes.

Wildcard Mask Calculator

Name: Wildcard Mask Calculator
Availability: InStock
Author: Nham Vu

Enter a subnet mask or CIDR prefix length to instantly get the wildcard (inverse) mask used in Cisco ACLs and OSPF.

Wildcard Mask Input

Subnet Mask

Enter in dotted-decimal format.

Common Prefixes

Enter a subnet mask or CIDR prefix, then click Calculate.

Wildcard Mask

0.0.0.255

Use this value in Cisco ACLs and OSPF network statements.

Conversion Details

CIDR Prefix

Subnet Mask

Wildcard Mask

Addressable Hosts

ACL Example

Binary Breakdown

Label	Binary (32 bits)

Must match (0 in wildcard) Ignored (1 in wildcard)

Copied!

Summary

Enter a subnet mask or CIDR prefix length to instantly get the wildcard (inverse) mask used in Cisco ACLs and OSPF.

How it works

Enter a subnet mask in dotted-decimal form (e.g. 255.255.255.0) or a CIDR prefix length (e.g. /24 or just 24).
Click "Calculate" to compute the wildcard mask.
The wildcard mask is derived by inverting every bit of the subnet mask (255.255.255.255 XOR subnet mask).
Results include the wildcard mask, subnet mask, CIDR prefix, and a binary breakdown for all four octets.
Use the "Copy" buttons to paste individual values directly into your router or firewall configuration.

Use cases

Write Cisco IOS access-list permit/deny statements that match entire subnets.
Configure OSPF network commands with the correct wildcard mask.
Verify ACL wildcard masks when troubleshooting traffic filtering.
Convert subnet masks learned from CCNA studies to wildcard format.
Generate wildcard masks for BGP prefix-list or route-map entries.
Double-check firewall rules that use inverse mask notation.
Quickly identify how many host bits a given wildcard mask covers.
Support CCIE/CCNP lab practice with instant mask conversion.

Frequently Asked Questions

Last updated: 2026-06-10 · Reviewed by Nham Vu