Wildcard Mask Calculator

What is a wildcard mask?

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask uses 1-bits to identify the network portion, a wildcard mask uses 0-bits to identify bits that must match, and 1-bits for bits that are ignored (don't-care).

The formula: wildcard = 255.255.255.255 − subnet mask.

Wildcard masks in Cisco ACLs

In access control lists, the wildcard mask follows the IP address to define the range of addresses matched by the entry:

access-list 10 permit 10.10.10.0 0.0.0.255

This permits any address in 10.10.10.0/24. The wildcard 0.0.0.255 means: first three octets must match exactly (0 = must match), fourth octet is ignored (255 = any value).

Two shorthand keywords replace common wildcard patterns:

• host 192.168.1.5 is equivalent to 192.168.1.5 0.0.0.0 — match one specific address.
• any is equivalent to 0.0.0.0 255.255.255.255 — match all addresses.

Wildcard masks in OSPF

OSPF uses wildcard masks in the network command to determine which interfaces participate in OSPF and which area they belong to:

router ospf 1
 network 10.0.0.0 0.255.255.255 area 0

This enables OSPF on all interfaces with addresses in the 10.0.0.0/8 range and assigns them to area 0. A more specific statement using /24 wildcard activates OSPF only on interfaces in a single /24 subnet.

Common mistake — using subnet mask instead of wildcard

Cisco IOS will accept a subnet mask as a wildcard argument without error, but the result is the opposite of what you intend. The mask 255.255.255.0 as a wildcard means: ignore the first three octets, match only addresses where the fourth octet is exactly zero. This matches one address per /24, not the whole subnet.

Always double-check: wildcard masks tend to start with zeros (for the fixed portion) and end with values like 255, 127, 63, 31, 15, 7, 3, 1 (for the variable portion). Subnet masks do the opposite.

What are wildcard masks and how they differ from subnet masks

A wildcard mask and a subnet mask are mathematical inverses of each other, but they serve fundamentally different purposes. A subnet mask defines the boundary between the network and host portions of an IP address: bits set to 1 identify the network, bits set to 0 identify hosts. A wildcard mask defines which bits in an address must match and which bits are irrelevant: bits set to 0 mean "this bit must match exactly," and bits set to 1 mean "this bit can be anything — I don't care." This inversion is why the formula wildcard = 255.255.255.255 − subnet mask works: a network bit (1) in the subnet mask becomes a must-match bit (0) in the wildcard, and a host bit (0) in the subnet mask becomes a don't-care bit (1) in the wildcard.

The practical consequence is that wildcard masks can express matching conditions that subnet masks cannot. Subnet masks must be contiguous (all 1-bits on the left, all 0-bits on the right). Wildcard masks have no such restriction. You can write a wildcard that matches only even-numbered hosts in a subnet, or only addresses where the third octet is in the range 10–15, or only odd-numbered subnets. These non-contiguous wildcards are rare in practice but valid in Cisco IOS ACLs and OSPF network statements. For standard subnet matching, always derive the wildcard from the subnet mask using the formula above — this keeps the masks contiguous and easy to verify.

Wildcard masks in Cisco ACLs — detailed examples

Access control lists on Cisco IOS use wildcard masks to define which packets match each rule. The syntax is permit|deny protocol source source-wildcard destination destination-wildcard. Understanding wildcard semantics is critical because an incorrectly specified wildcard will either block legitimate traffic or permit traffic that should be denied — and Cisco IOS will not warn you that your wildcard is logically inconsistent.

Example 1 — permit a single /24 subnet: permit ip 192.168.10.0 0.0.0.255 any. The wildcard 0.0.0.255 means: first three octets must match (0.0.0 → must match), fourth octet is ignored (255 → any value). This matches any source in the range 192.168.10.0–192.168.10.255. Example 2 — permit a range of /24 subnets (say 10.1.0.0 through 10.1.3.0): the summary is 10.1.0.0/22, wildcard 0.0.3.255: permit ip 10.1.0.0 0.0.3.255 any. Example 3 — permit only the network address of a /26: permit ip 172.16.5.64 0.0.0.0 any — the all-zeros wildcard means match exactly this one address. IOS shorthand: host 172.16.5.64 is equivalent. Example 4 — match all traffic: permit ip any any — equivalent to 0.0.0.0 255.255.255.255. Always verify ACL behavior with show access-lists and inspect the hit counters after sending test traffic.

Wildcard masks in OSPF — neighbor formation and area assignment

OSPF uses the network command in the routing process configuration to determine two things: which interfaces will run OSPF (send and receive hello packets), and which OSPF area each interface belongs to. The wildcard mask in the network statement controls which interface IP addresses are matched by the command. This makes wildcard mask accuracy critical for correct area assignment.

Consider a router with interfaces at 10.0.0.1/30 (backbone link), 192.168.1.1/24 (area 1 LAN), and 192.168.2.1/24 (area 1 LAN). Correct configuration: network 10.0.0.0 0.0.0.3 area 0 enables OSPF on the /30 backbone link and assigns it to area 0. network 192.168.0.0 0.0.1.255 area 1 enables OSPF on both /24 LAN interfaces and assigns them to area 1. The wildcard 0.0.1.255 matches any address where the first two octets are 192.168, the third octet is 0 or 1 (the "1" bit in position 8 of the third octet is a don't-care), and the fourth octet is anything. If you accidentally reverse the mask — putting the wrong area on the backbone link — OSPF will attempt to form adjacencies with the wrong neighbors, and the routing table will be incorrect. Use show ip ospf interface brief after configuring to verify each interface's area assignment before the network goes live.