Wildcard Mask Calculator
Convert any CIDR or subnet mask to its corresponding wildcard mask. Wildcard masks are used in access control lists (ACLs), OSPF, EIGRP, and other network configurations to define which bits must match and which bits can vary.
What Is a Wildcard Mask?
A wildcard mask is the bitwise inverse of a subnet mask. While a subnet mask uses 1s to represent the network portion of an address and 0s for the host portion, a wildcard mask flips this: 0s mean "must match exactly" and 1s mean "ignore this bit." For example, the subnet mask 255.255.255.0 has a wildcard mask of 0.0.0.255, meaning the first three octets must match and the last octet can be any value.
Wildcard masks are most commonly used in Cisco IOS access control lists (ACLs) to specify which IP addresses should be permitted or denied. They also appear in routing protocol configurations such as OSPF network statements and EIGRP. Unlike subnet masks, wildcard masks are not limited to contiguous bits — you can create non-contiguous wildcard masks for more granular matching, though this is rarely needed in practice.
How to Calculate a Wildcard Mask
To calculate the wildcard mask manually, take the subnet mask in binary and invert every bit. For a /24 subnet mask (255.255.255.0), the binary is 24 ones followed by 8 zeros. Inverting gives 24 zeros followed by 8 ones, which is 0.0.0.255 in decimal. For a /27 mask (255.255.255.224), the binary is 27 ones and 5 zeros. Inverted, it becomes 27 zeros and 5 ones — 0.0.0.31.
The calculator also shows the binary representation of both the subnet mask and wildcard mask, making it easy to verify the bit inversion visually. This is especially helpful when learning subnetting or debugging ACL configurations.
In practice, OSPF uses wildcard masks in its network statements to advertise specific interfaces into the OSPF process, while ACLs use them to filter traffic based on source or destination IP ranges. The inverse relationship means 0.0.0.0 in a wildcard mask matches nothing, while 255.255.255.255 matches everything.
Pair this tool with the Subnet Calculator for a complete subnetting workflow, use the Binary Converter to explore individual octet values, or check the Wildcard Calculator for quick mask conversions during router configuration.