Wildcard Mask Calculator
Convert between a subnet mask and the wildcard mask Cisco ACLs use.
System verdict
RESULT255.255.255.0 ↔ wildcard 0.0.0.255
Cisco access lists and OSPF network statements take the wildcard form, where a 0 bit means "must match" and a 1 bit means "ignore" — the exact opposite of a subnet mask.
- Subnet mask
- 255.255.255.0
- Wildcard mask
- 0.0.0.255
- Prefix length
- /24
What this cannot tell you
- Pure bitwise arithmetic. A wildcard is simply the inverse of a subnet mask.
- Non-contiguous masks have no prefix length. They are invalid as subnet masks but valid in access lists, and this tool allows them rather than refusing.
How this calculation works
A wildcard mask is the bitwise inverse of a subnet mask: where the subnet mask has a 1, the wildcard has a 0, and vice versa. Cisco access lists and OSPF network statements take the wildcard form. Enter either a mask, a wildcard or a prefix and this returns all three.
What the results mean
- Wildcard mask
- The form Cisco ACLs expect. A 0 bit means "this bit must match", a 1 bit means "ignore this bit" — the opposite of a subnet mask.
- Non-contiguous
- A mask whose 1-bits are not all together. Invalid as a subnet, but valid and useful in an ACL — for example, matching only odd-numbered subnets.
Common problems and fixes
- I entered a wildcard and got the mask, or vice versa
- The tool decides which you entered from the leading bits — subnet masks start with 1s, wildcards with 0s — and shows both forms either way, so the answer is there regardless.
- My ACL mask is "invalid"
- It is not — it is non-contiguous, which this tool allows. A prefix length is shown as "non-contiguous" because such a mask does not correspond to a standard subnet, but it is legitimate in an access list.
Frequently asked questions
Why do Cisco ACLs use wildcard masks instead of subnet masks?
Historical design, but it has a practical upside: because the bits are independent, a wildcard can match patterns a subnet mask cannot, such as every odd subnet or a specific host bit across ranges. The inverted meaning trips people up constantly, which is why a converter helps.
What is the wildcard for a single host?
0.0.0.0 — every bit must match. The subnet-mask equivalent is 255.255.255.255, or /32. To match any host, the wildcard is 255.255.255.255.