Wildcard Mask Calculator

The Wildcard Mask Calculator generates wildcard masks from CIDR notation, subnet masks, or IP address ranges. Wildcard masks are the bitwise inverse of subnet masks, used in Cisco IOS access control lists (ACLs), OSPF network statements, and EIGRP configurations to match IP address ranges.

Understanding Wildcard Masks

If you work with Cisco equipment, wildcard masks are something you will use constantly but might never fully think through. A wildcard mask looks like a subnet mask written backwards -- where a subnet mask uses 1-bits to mark the network portion and 0-bits for the host portion, a wildcard mask does exactly the opposite. A 0 bit means "this bit must match the base address exactly," and a 1 bit means "this bit can be anything." So the wildcard 0.0.0.255 paired with the base address 192.168.1.0 matches every address from 192.168.1.0 through 192.168.1.255 -- the first three octets must match, and the last octet can be anything.

The reason Cisco uses wildcard masks instead of subnet masks in ACLs and routing protocol configurations is flexibility. Subnet masks are always contiguous -- a run of 1s followed by a run of 0s -- because they define a single continuous block of addresses. Wildcard masks can technically be non-contiguous, which allows matching patterns that do not align to traditional subnets. For example, a wildcard of 0.0.0.254 matches only even-numbered addresses in the last octet. While non-contiguous wildcards are rarely used in practice, the capability exists in the ACL engine.

For the vast majority of real-world configurations, you are simply converting between subnet masks and wildcard masks for CIDR-aligned ranges. The conversion is straightforward: subtract each octet of the subnet mask from 255. This tool automates that conversion and also handles the more complex case of non-CIDR-aligned IP ranges, where multiple wildcard entries are needed to cover the range precisely.

How to Calculate a Wildcard Mask

1. Enter a CIDR block (e.g., 192.168.1.0/24), a subnet mask (e.g., 255.255.255.0), or an IP range
2. The calculator inverts the subnet mask bits -- 1s become 0s and 0s become 1s
3. The resulting wildcard mask is displayed alongside the matching IP range
4. For non-CIDR-aligned ranges, the tool computes the minimum set of wildcard entries needed

Wildcard Mask Examples

When to Use This Tool

• Writing Cisco extended ACLs -- convert subnet notation to the wildcard mask format that access-list commands require
• Configuring OSPF network statements -- use network 10.0.0.0 0.255.255.255 area 0 with the correct wildcard
• Setting up EIGRP -- wildcard masks define which interfaces participate in routing
• Matching non-contiguous ranges -- when an IP range does not align to a single CIDR block, the tool calculates the fewest wildcard entries to cover it exactly
• Auditing existing ACLs -- verify that wildcard masks in configurations match the intended address ranges
• Converting from Terraform to Cisco configs -- translate CIDR notation used in cloud to wildcard masks used on routers

How Wildcard Masks Work in Cisco IOS

Bit-Level Logic

In a wildcard mask, each bit has a specific meaning:

• 0 = this bit must match the corresponding bit in the base address
• 1 = this bit can be anything (don't care)

Base Address: 192.168.1.0    → 11000000.10101000.00000001.00000000
Wildcard:     0.0.0.255      → 00000000.00000000.00000000.11111111
                                ↑ must match ↑              ↑ any ↑

This matches all addresses from 192.168.1.0 to 192.168.1.255.

Wildcard vs. Subnet Mask

To convert: subtract each octet of the subnet mask from 255.

Subnet Mask:  255.255.255.240
Wildcard:     255-255=0, 255-255=0, 255-255=0, 255-240=15
Result:       0.0.0.15

Special Wildcard Values

OSPF Network Statement Example

To advertise all interfaces in the 10.10.0.0/16 range into OSPF Area 0:

router ospf 1
 network 10.10.0.0 0.0.255.255 area 0

The wildcard 0.0.255.255 means the first two octets must be 10.10, while the last two can be anything.

Non-CIDR-Aligned Ranges

If you need to match 10.0.0.0 through 10.0.0.200, this range does not fall on a single CIDR boundary. The calculator determines the minimum set of wildcard entries:

10.0.0.0   0.0.0.127    → covers 10.0.0.0 - 10.0.0.127
10.0.0.128 0.0.0.63     → covers 10.0.0.128 - 10.0.0.191
10.0.0.192 0.0.0.7      → covers 10.0.0.192 - 10.0.0.199
10.0.0.200 0.0.0.0      → covers 10.0.0.200

Wildcard Masks in Practice

The most common mistake when writing ACLs is confusing the subnet mask with the wildcard mask. If you accidentally use 255.255.255.0 instead of 0.0.0.255 in an ACL statement, the ACL will match a completely different set of addresses -- or in many cases, the router will reject the configuration entirely. On Cisco devices, some newer IOS versions will accept a warning and auto-convert, but relying on that behavior is risky. Always double-check whether the context expects a subnet mask or a wildcard mask.

Another practical consideration is ACL performance. When a range does not fall on a CIDR boundary and requires multiple wildcard entries, each entry adds processing overhead to packet matching. For access lists applied to high-throughput interfaces, minimizing the number of entries matters. This calculator produces the minimum set of wildcard pairs to cover any arbitrary range, which helps keep your ACLs as efficient as possible. If performance is critical and the extra addresses are acceptable, it may be better to use a single larger CIDR block that encompasses the range rather than multiple precise entries.

When migrating configurations between platforms, remember that not all vendors use wildcard masks. Juniper JUNOS, Palo Alto PAN-OS, and most cloud platforms use CIDR notation or standard subnet masks in their ACL equivalents. If you are translating a Cisco ACL to a Palo Alto security policy, you need to convert each wildcard mask back to a CIDR block -- which this tool does in reverse. Having the conversion table memorized for common prefixes (/24 = 0.0.0.255, /16 = 0.0.255.255, /8 = 0.255.255.255) covers most cases, but the calculator handles the non-obvious ones.

Frequently Asked Questions

How do I convert a subnet mask to a wildcard mask?

Subtract each octet of the subnet mask from 255. For 255.255.255.192: 255-255=0, 255-255=0, 255-255=0, 255-192=63, giving wildcard 0.0.0.63. Alternatively, the wildcard is the bitwise NOT of the subnet mask.

Why does Cisco use wildcard masks instead of subnet masks in ACLs?

Wildcard masks allow non-contiguous bit patterns, enabling matching of address patterns that do not align to traditional subnets. For example, a wildcard of 0.0.0.254 matches only even-numbered addresses. While non-contiguous wildcards are rare, the flexibility is built into the ACL syntax. OSPF and EIGRP use wildcard masks for consistency with ACL syntax.

What wildcard mask matches a single host?

The wildcard mask 0.0.0.0 matches exactly one address because every bit must match. In Cisco IOS, you can use the shorthand host 192.168.1.1 instead of writing 192.168.1.1 0.0.0.0.

What wildcard mask matches all addresses?

The wildcard mask 255.255.255.255 matches any IP address because every bit is a "don't care" bit. In Cisco IOS, you can use the shorthand any instead of writing 0.0.0.0 255.255.255.255.

Can I use wildcard masks on non-Cisco platforms?

Most non-Cisco platforms (Juniper, Palo Alto, Fortinet, cloud firewalls) use CIDR notation or subnet masks instead of wildcard masks. If you are migrating configurations from Cisco to another platform, you will need to convert wildcard masks back to CIDR blocks. This tool handles both directions of the conversion.

Related Tools

• IPv4 Subnet Calculator - Calculate network, broadcast, and host range from CIDR notation
• Netmask ↔ CIDR Converter - Convert between subnet mask notation and CIDR prefix length
• Network Address Calculator - Find the network address for any IP and subnet mask
• Broadcast Address Calculator - Find the broadcast address for any subnet
• Usable Hosts Calculator - Calculate number of usable host addresses in a subnet
• IP in Subnet? Checker - Check if an IP address belongs to a specific subnet