What is IP Header, Its Components, and Calculation?
The Internet Protocol header is the initial portion of an IP packet that contains information about the packet's…
A wildcard mask is a subnet mask with every bit inverted. Subtract each octet from 255 to convert either way, so 255.255.255.0 becomes 0.0.0.255. In an ACL a wildcard bit of 0 means the address bit must match and a 1 means ignore it.
Key takeaways
- Subtract each octet from 255 to convert between a subnet mask and a wildcard mask, in either direction.
- A wildcard bit of 0 means match that address bit exactly, and a 1 means ignore it, which is the opposite of a subnet mask.
- The last octet follows the block size, so a /26 has blocks of 64 and a wildcard of 63.
- OSPF and EIGRP network statements take wildcards, but prefix lists take a prefix length instead.
- Using a subnet mask where a wildcard belongs is accepted silently and can open far more than intended.
- For a single host the wildcard is 0.0.0.0, which most configurations write as the host keyword.
This wildcard mask calculator takes a prefix, a subnet mask or a wildcard mask and gives you the other two, with the binary and the usable host count. It works in either direction, so you can paste in 0.0.0.255 just as happily as /24.
Wildcard mask calculator
Enter /24, 255.255.255.0 or 0.0.0.255. The tool works out which one you gave it.
Everything runs in your browser. Nothing you type is sent anywhere, which matters when the thing you are pasting is your own internal addressing.
What the bits actually mean
A subnet mask marks which bits belong to the network. A wildcard mask marks which bits a device should bother comparing. They carry the same information, inverted.
In an access list, a wildcard bit of 0 means the corresponding bit in the address has to match exactly. A wildcard bit of 1 means skip it, treat any value as acceptable. So 0.0.0.255 says match the first three octets and ignore the last, which is exactly a /24.
That is why the conversion is simple arithmetic. Subtract each octet of the subnet mask from 255 and you have the wildcard. Subtract again and you are back where you started.
Why routers use them at all
Wildcard masks predate CIDR notation in Cisco configuration and they are more flexible than a prefix length. Because the bits are only conventionally contiguous rather than required to be, a wildcard can in principle match patterns a prefix cannot, such as every odd numbered subnet. That capability is rarely useful and frequently a source of bugs, which the mistakes section covers.
The values you will actually use
Worth memorising the first and last rows at least. A /24 is 0.0.0.255 and a single host is 0.0.0.0, and between them those two account for most of the access list lines ever written.
The pattern for the last octet follows the block size. A /26 splits into blocks of 64, so the wildcard is 63, one less than the block. A /30 has blocks of 4, so the wildcard is 3. If you already think in block sizes from subnetting, you already know wildcard masks. Our subnet calculator shows the block size for any prefix if you want to check.
Where they turn up
Access lists, standard and extended. This is where most people meet them. The mask follows the address it applies to.
OSPF network statements. The network command takes a wildcard rather than a subnet mask, which catches out almost everybody once. Matching a single interface means a /32 wildcard of 0.0.0.0.
EIGRP network statements. Same idea, though the wildcard is optional here. Leave it out and EIGRP assumes the classful boundary, which is rarely what you wanted.
Prefix lists do not use them. A prefix list takes a normal prefix length with ge and le modifiers. Mixing the two syntaxes is a common first day mistake.
Mistakes that do not produce an error
Using the subnet mask by accident. Writing 255.255.255.0 where a wildcard belongs is the classic. The line is accepted. It then matches a range you did not intend, and in a permit statement that can quietly open far more than you meant.
Using 0.0.0.255 for a /25. A /25 is 128 addresses, so the wildcard is 0.0.0.127. Using 255 covers both halves of the /24, so your rule applies to the other subnet too. Nothing warns you.
Non contiguous bits. Something like 0.0.255.0 is syntactically legal and matches a strange discontinuous pattern. Occasionally this is deliberate. Far more often it is a typo that produces behaviour nobody can explain later. The calculator above rejects these on purpose.
Forgetting the host shorthand. For a single address, host 10.1.1.1 and 10.1.1.1 0.0.0.0 are identical. Both are fine. Mixing them within one access list makes it harder to read than it needs to be.
Questions people ask
How do I convert a subnet mask to a wildcard by hand?
Subtract each octet from 255. So 255.255.255.192 becomes 0.0.0.63. It works in both directions because the operation is its own inverse.
Why does OSPF use a wildcard instead of a subnet mask?
Historical consistency with access lists rather than any technical necessity. The network statement is effectively a match rule, and match rules in that generation of syntax took wildcards. Newer platforms often let you configure OSPF directly on the interface and skip the question entirely.
Can a wildcard mask have non contiguous bits?
Yes, and that is the difference from a subnet mask, which cannot. It allows patterns such as matching only even numbered subnets. It is legal, it is rarely intentional, and it makes a configuration very hard for the next person to read.
What is the wildcard mask for a single host?
0.0.0.0, meaning every bit has to match. Most configurations write host 10.1.1.1 instead, which the device expands to the same thing.
Does the calculator store what I type?
No. It is JavaScript running inside your own browser, with no request to a server and no logging. The same is true of every tool on the site, which are collected on the free networking tools page.
