Wildcard Mask Calculator

Wildcard Mask vs. Subnet Mask: What's the Difference?

A subnet mask and a wildcard mask describe the exact same network boundary, just read in opposite directions. Mixing them up is one of the most common reasons an ACL matches the wrong addresses, so it's worth being precise about which one belongs in which command.

Subnet Mask Basics: Network Portion vs Host Portion

A subnet mask uses 1 bits to mark the network portion of an address — the part that must match exactly — and 0 bits for the host portion, which varies from device to device. You'll see this notation in operating-system network configuration, DHCP scopes, and routing tables. 255.255.255.0 is a /24: the first three octets identify the network, and the last one is left for host assignment. Subnetting is simply the practice of carving one large network into several smaller subnets this way, and each of those subnets is also called a subnetwork.

Wildcard Mask Basics: Don't-Care Bits Explained

A wildcard mask inverts that logic across the same 32 bits. Here, a 0 bit means "must match exactly" and a 1 bit means "don't care" — any value is acceptable in that position. Wildcard masks show up in Cisco ACLs, OSPF and EIGRP network statements, and BGP network advertisements rather than in general OS configuration. Most of the values you'll write are contiguous, mirroring standard CIDR notation, but Cisco IOS technically permits a non-contiguous pattern too (for example, matching only even-numbered addresses) — valid, but rarely used and generally discouraged.

Using Wildcard Masks in Cisco ACLs and Interior Gateway Protocols

These values show up constantly once you start writing Cisco IOS configuration, and knowing the common ones by heart will save you real time in the field.

Cisco ACL Wildcard Mask Examples

A Cisco ACL entry pairs a network address with an inverted value to define which addresses a permit or deny line applies to. The table below covers the ones you'll reuse most in day-to-day network engineering:

Notice the extremes: 0.0.0.0 matches exactly one address, while 255.255.255.255 paired with permit any matches every address on the network. A frequent mistake is typing the subnet mask directly into an ACL line instead of its inverse — the router will accept the command syntactically but silently match the wrong set of addresses, which is a hard bug to spot during a live troubleshooting session. Running the value through the calculator above first removes that risk entirely.

Standard ACLs vs Extended ACLs

Beyond simple ACLs, the same inverted notation appears in OSPF and EIGRP network statements — both are routing protocols that advertise which interfaces participate in a routing process, and both expect this syntax instead of a conventional subnet mask. A typical router ospf configuration block pairs a network address with the inverted value the same way an ACL does. Standard ACLs filter on source address alone using a single value, while extended adds protocol, destination, and port matching — but the underlying math is identical in both. Access control lists, sometimes just called access lists, and BGP advertisements round out the main places you'll use this notation instead of a subnet mask.

• Standard ACLs — filter by source address only, one wildcard value per line
• Extended — adds protocol, destination address, and port matching
• Interior gateway protocols — apply the same wildcard-value pairing under the router configuration

Beyond Wildcard Masks: IPv6, Gateways, and Related Subnet Calculator Tools

Once you're comfortable converting a mask by hand, it's worth knowing where the same ideas extend into IPv6 and into the wider set of subnet calculator tools network engineers reach for daily.

IPv6 Prefixes, Hex IDs, and Reverse DNS Lookup

IPv6 doesn't use wildcard masks the way IPv4 ACLs do, but it keeps the same prefix-length idea: an IPv6 network prefix ranges from /1 to /128, playing the same role a subnet mask plays for IPv4. IPv6 addresses are written in hexadecimal rather than the dotted-decimal IPv4 format you're used to, grouped into eight blocks separated by colons. A full IPv6 calculator will typically also display the address as a binary ID, an integer ID, and a hex ID, plus an IPv4 mapped address for dual-stack compatibility and a 6to4 prefix if you're bridging the two protocols. Reverse DNS lookup depends on the same addressing math too — it resolves an address to an in-addr.arpa domain name by reversing the octet order, and it's worth confirming the IP type (public vs private) before you rely on the result.

• Integer ID representation of the same address
• Hex ID and an IPv4 mapped address for dual-stack use
• Reverse DNS in-addr.arpa formatting

VLSM, Supernetting, and Other Subnet Calculator Tools

Variable Length Subnet Masking (VLSM) sits right next to this conversion in most toolkits: it lets you carve one block into differently sized subnets instead of wasting address space on a uniform prefix, while supernetting does the reverse, aggregating several small blocks into one larger supernet for a cleaner routing table. None of these replace the mask math above; they simply extend the same addressing fundamentals to larger-scale network design. A default gateway is simply the first usable address in a subnet, configured on every device that needs to reach outside its own network. If you're managing IP addressing end-to-end, a subnet overlap checker to catch conflicting CIDR ranges and a bandwidth calculator for transfer-time estimates are natural companions to keep alongside this tool. Save the page or bookmark this calculator so the next ACL line, protocol update, or IPv6 prefix check is one click away instead of a mental subtraction exercise.