Wildcard Mask Calculator

Convert between a subnet mask and the wildcard mask Cisco ACLs use.

What you provide

Result

255.255.255.0 ↔ wildcard 0.0.0.255

Cisco access lists and OSPF network statements take the wildcard form, where a 0 bit means "must match" and a 1 bit means "ignore" — the exact opposite of a subnet mask.

Mask and wildcard, split at /24

Subnet mask

11111111111111111111111100000000

255.255.255.0 — 1s mark the network

Wildcard mask

00000000000000000000000011111111

0.0.0.255 — the exact inverse, which is what ACLs and OSPF take

  • Network — 24 bits
  • Host — 8 bits
Diagnostic telemetry
Subnet mask
255.255.255.0
Wildcard mask
0.0.0.255
Prefix length
/24

What this cannot tell you

  • Pure bitwise arithmetic. A wildcard is simply the inverse of a subnet mask.
  • Non-contiguous masks have no prefix length. They are invalid as subnet masks but valid in access lists, and this tool allows them rather than refusing.

Take this with you

Wildcard Mask Calculator on RunTheTests — free browser-based netmath tools, no sign-up.