Wildcard Mask Calculator

What is a wildcard mask?

A wildcard mask tells a device which bits of an address must match and which bits to ignore. A 0 bit means "this bit must match exactly" and a 1 bit means "ignore this bit". It works like a subnet mask turned inside out: the subnet mask 255.255.255.0 becomes the wildcard mask 0.0.0.255, which says the first three octets must match and the last octet can be anything. That is precisely the set of addresses in a /24.

Wildcard masks appear in Cisco IOS access lists, in the network command of OSPF and EIGRP, and in some other vendors' route and filter statements. Interfaces, hosts, and routing tables use subnet masks instead, so you will often need to convert between the two.

How to calculate a wildcard mask

Subtract each octet of the subnet mask from 255. For 255.255.255.224 the octets are 255, 255, 255, and 224, so the wildcard mask is 0, 0, 0, and 31, written 0.0.0.31. Going the other way works identically: subtract a wildcard from 255.255.255.255 to get the subnet mask.

There is a shortcut for the interesting octet. The wildcard value is the block size minus one. A /27 has a block size of 32, so the wildcard is 31; a /22 has a block size of 4 in the third octet, so the wildcard is 0.0.3.255. The table shows the most common values:

Using wildcard masks in Cisco configurations

To permit every host in 192.168.1.0/24 in a standard numbered ACL, write:

An extended ACL adds a protocol and destination, for example:

In OSPF, the network statement uses the same format to choose which interfaces take part in the process:

Two keywords save typing. host 10.1.1.1 is shorthand for 10.1.1.1 0.0.0.0, a single address, and any is shorthand for 0.0.0.0 255.255.255.255, every address.

Matching ranges that are not a single subnet

Wildcard masks are more flexible than subnet masks, which is one reason they survive. Suppose you want to match 192.168.4.0 through 192.168.7.255, four consecutive /24s. The block size in the third octet is 4 and 4 is a multiple of 4, so one line does it: 192.168.4.0 0.0.3.255. The range has to start on a multiple of its size, exactly as with subnetting.

Wildcard masks can even be discontiguous, which a subnet mask cannot. The pattern 192.168.1.1 0.0.0.254 ignores every bit of the last octet except the last one, so it matches only odd-numbered hosts in 192.168.1.0. Such patterns are legitimate in access lists but rarely a good idea, because they are hard to read and to audit. Interfaces and routing tables only understand contiguous masks.

Worked example: from an address range to a wildcard

Say you need to match 172.16.32.0 through 172.16.47.255. That is 16 consecutive values in the third octet, so the block size is 16 and the third-octet wildcard is 16 − 1 = 15. The start (32) is a multiple of 16, so the range is aligned and one entry covers it: 172.16.32.0 0.0.15.255. The matching subnet mask is 255.255.240.0, which is a /20. If the range had started at 172.16.30.0 it would not be aligned, and you would need several entries instead of one. Enter 0.0.15.255 in the calculator above with "Wildcard mask" selected to confirm the result.

Common mistakes

• Using a subnet mask where a wildcard is expected. permit 192.168.1.0 255.255.255.0 ignores the first three octets and requires the last one to be 0, which matches almost nothing you intended.
• Using a wildcard where a subnet mask is expected. Interface addresses, static routes, and many firewalls (Cisco ASA for example) take ordinary subnet masks or prefix lengths. Check the platform's syntax.
• Misaligned networks. 10.1.1.5 0.0.0.31 works, because bits that are ignored do not matter, but writing the real network address (10.1.1.0) keeps the configuration readable.
• Forgetting ACL order. ACLs are checked top to bottom and end with an implicit deny, so a correct wildcard in the wrong position still blocks traffic.

Related tools and guides

Frequently asked questions