YurlieWildcard Mask Calculator
Convert between subnet masks and wildcard masks. Wildcard masks are the bitwise inverse of subnet masks, used in Cisco ACLs and OSPF.
255.255.255.0/240.0.0.2550x000000FFBinary
/242562540xFFFFFF00Common mask reference
Wildcard Masks vs Subnet Masks
While a standard subnet mask uses binary 1 to represent network bits and 0 to represent host bits, a wildcard mask (also called an inverse mask) flips this logic:
- Binary 0: The bit in the packet header must match the bit in the specified network address exactly.
- Binary 1:The bit is a wildcard (ignored / "don't care"). The packet header can have either 0 or 1 in this position.
Mathematical Inversion Formula
For standard contiguous subnets, calculating the wildcard mask is a simple subtraction of the subnet mask from 255.255.255.255:
| Step | Octet 1 | Octet 2 | Octet 3 | Octet 4 | Result |
|---|---|---|---|---|---|
| Base (All 1s) | 255 | 255 | 255 | 255 | 255.255.255.255 |
| Subnet Mask (/27) | 255 | 255 | 255 | 224 | 255.255.255.224 |
| Wildcard Mask | 0 | 0 | 0 | 31 | 0.0.0.31 |
Cisco IOS Configuration Examples
In Cisco network administration, wildcard masks are ubiquitous in access control and dynamic routing:
- Cisco Extended ACL (Permit HTTPS for /24 Subnet):
access-list 101 permit tcp 192.168.10.0 0.0.0.255 any eq 443 - OSPF Routing Protocol (Enable Area 0 on Interface Range):
router ospf 1 network 10.50.0.0 0.0.255.255 area 0 - Single Specific Host ACL Rule:
(Equivalent to using the keyword:access-list 10 permit 192.168.1.50 0.0.0.0access-list 10 permit host 192.168.1.50)
Subnet to Wildcard Mask Conversion Reference Table
| CIDR Prefix | Subnet Mask | Wildcard Mask | Matching Host Range Count |
|---|---|---|---|
/24 | 255.255.255.0 | 0.0.0.255 | 256 addresses |
/25 | 255.255.255.128 | 0.0.0.127 | 128 addresses |
/26 | 255.255.255.192 | 0.0.0.63 | 64 addresses |
/27 | 255.255.255.224 | 0.0.0.31 | 32 addresses |
/28 | 255.255.255.240 | 0.0.0.15 | 16 addresses |
/29 | 255.255.255.248 | 0.0.0.7 | 8 addresses |
/30 | 255.255.255.252 | 0.0.0.3 | 4 addresses |
/32 | 255.255.255.255 | 0.0.0.0 | 1 address (Single host) |
Frequently Asked Questions
What is a wildcard mask in computer networking?
A wildcard mask is a 32-bit mask used by networking hardware (such as Cisco routers and firewalls) to specify which bits of an IP address must be matched. A bit value of 0 means "the corresponding bit must match exactly", while a bit value of 1 means "the bit is ignored (wildcard/don't care)".
How do you calculate a wildcard mask from a subnet mask?
To calculate a wildcard mask, subtract each octet of the standard subnet mask from 255 (or 255.255.255.255 - Subnet Mask). For example, with a /26 subnet (255.255.255.192): 255-255=0, 255-255=0, 255-255=0, and 255-192=63, resulting in a wildcard mask of 0.0.0.63.
Why does Cisco IOS use wildcard masks instead of standard subnet masks in ACLs?
Unlike contiguous subnet masks, wildcard masks allow non-contiguous (discontiguous) bit patterns in advanced routing rules. For example, a wildcard mask like 0.0.0.254 can match only even-numbered IP addresses across an entire subnet in a single Access Control List entry.
What is the difference between wildcard mask 0.0.0.0 and 255.255.255.255?
A wildcard mask of 0.0.0.0 means "all 32 bits must match exactly", which specifies a single individual host (equivalent to the "host" keyword in Cisco ACLs or /32). A wildcard mask of 255.255.255.255 means "all 32 bits are ignored", matching any IP address (equivalent to the "any" keyword in Cisco ACLs).
Where are wildcard masks used in real-world network engineering?
Wildcard masks are standard syntax in Cisco IOS Access Control Lists (Standard and Extended IPv4 ACLs), OSPF network area definitions ("network 10.0.0.0 0.255.255.255 area 0"), EIGRP network statements, and BGP route-maps.