Skip to content
/24ipcalc.net

Cisco ACL · OSPF

Wildcard mask calculator.

Convert a subnet mask or CIDR prefix into a wildcard mask — or paste a wildcard to get the matching subnet mask and prefix.

Enter a wildcard (0.0.7.255), a subnet mask (255.255.248.0) or a prefix (/21)

CIDR prefix/21
Subnet mask255.255.248.0
Wildcard mask0.0.7.255
Total addresses2,048
Usable hosts2,046
Binary mask11111111.11111111.11111000.00000000

What is a wildcard mask?

A wildcard mask is the inverse of a subnet mask. Where a subnet mask uses 1s to mark network bits, a wildcard mask uses 0s to mark the bits that must match and 1s for the bits that are ignored. Network engineers meet wildcard masks mainly in Cisco access lists and in routing protocol network statements.

How to calculate a wildcard mask

Subtract the subnet mask from 255.255.255.255, octet by octet:

Subnet mask   255.255.255.0
Subtract from 255.255.255.255
Wildcard      0.0.0.255

Wildcard mask examples

CIDRSubnet maskWildcard maskMatches
/32255.255.255.2550.0.0.01 host
/30255.255.255.2520.0.0.34 addresses
/28255.255.255.2400.0.0.1516 addresses
/24255.255.255.00.0.0.255256 addresses
/16255.255.0.00.0.255.25565,536 addresses
/00.0.0.0255.255.255.255any address

Using wildcard masks in Cisco ACLs

! Permit the 192.168.10.0/24 network
access-list 10 permit 192.168.10.0 0.0.0.255

! Permit a single host
access-list 10 permit host 192.168.10.5   ! same as 192.168.10.5 0.0.0.0

! Advertise a network in OSPF
router ospf 1
 network 10.1.0.0 0.0.255.255 area 0

The main IP subnet calculator shows the matching Cisco ACL line for any network automatically. For the reverse direction, try the subnet mask calculator.

Frequently asked questions

What is a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask. A 0 bit means “this bit must match” and a 1 bit means “ignore this bit”. The wildcard for 255.255.255.0 is 0.0.0.255.

How do I calculate a wildcard mask?

Subtract each octet of the subnet mask from 255. For 255.255.248.0 the wildcard is 0.0.7.255. Or enter the mask or CIDR prefix into the calculator above.

Where are wildcard masks used?

Cisco IOS access control lists (ACLs) and OSPF/EIGRP network statements use wildcard masks, for example: access-list 10 permit 192.168.1.0 0.0.0.255.

Can a wildcard mask be non-contiguous?

Yes. Unlike subnet masks, ACL wildcard masks may have gaps, such as 0.0.0.254 to match all odd or even addresses. This calculator handles standard contiguous wildcards that correspond to CIDR prefixes.

Related tools and guides