What is a Wildcard Mask?
A wildcard mask is the bitwise inverse (complement) of a subnet mask. While subnet masks use 1s to indicate network bits and 0s for host bits, wildcard masks flip this: 0s indicate bits that must match exactly, and 1s indicate "don't care" bits that can be any value.
Wildcard masks are primarily used in Cisco IOS for Access Control Lists (ACLs) and OSPF network statements. Understanding how to convert between subnet and wildcard masks is essential for Cisco network configuration. For complete subnet information, use our subnet calculator.
Quick Conversion
To convert subnet mask to wildcard: subtract each octet from 255. For 255.255.255.0: 255-255=0, 255-255=0, 255-255=0, 255-0=255. Result: 0.0.0.255
Where Wildcard Masks Are Used
Access Control Lists (ACLs)
Cisco ACLs use wildcard masks to define which IP addresses a rule applies to. A wildcard of 0.0.0.255 with network 192.168.1.0 matches all IPs from 192.168.1.0 to 192.168.1.255. The 0s in the wildcard mean those octets must match exactly, while 255 means any value is accepted.
OSPF Network Statements
When configuring OSPF, you specify which interfaces participate using network statements with wildcard masks. This allows precise control over which interfaces advertise routes.
EIGRP Network Statements
Similar to OSPF, EIGRP uses wildcard masks to define participating networks in its configuration.
Wildcard Mask Logic
| Wildcard Bit | Meaning | Example |
|---|---|---|
| 0 | Must match exactly | IP bit must equal network bit |
| 1 | Don't care (any value) | IP bit can be 0 or 1 |
Special Wildcard Masks
0.0.0.0 - Match Single Host
All zeros means every bit must match exactly. Used to specify a single IP address in ACLs (equivalent to the "host" keyword).
access-list 10 permit 192.168.1.100 0.0.0.0 ! Same as: access-list 10 permit host 192.168.1.100
255.255.255.255 - Match Any Host
All ones means no bits need to match. Used to match any IP address (equivalent to the "any" keyword).
access-list 10 permit 0.0.0.0 255.255.255.255 ! Same as: access-list 10 permit any
For subnet mask information, see our subnet mask calculator. To convert between CIDR and subnet mask formats, use our netmask to CIDR converter.