Wildcard Mask Calculator
Convert between a subnet mask and the wildcard mask Cisco ACLs use.
What you provide
Result
255.255.255.0 ↔ wildcard 0.0.0.255
Cisco access lists and OSPF network statements take the wildcard form, where a 0 bit means "must match" and a 1 bit means "ignore" — the exact opposite of a subnet mask.
Subnet mask
255.255.255.0 — 1s mark the network
Wildcard mask
0.0.0.255 — the exact inverse, which is what ACLs and OSPF take
- Network — 24 bits
- Host — 8 bits
- Subnet mask
- 255.255.255.0
- Wildcard mask
- 0.0.0.255
- Prefix length
- /24
What this cannot tell you
- Pure bitwise arithmetic. A wildcard is simply the inverse of a subnet mask.
- Non-contiguous masks have no prefix length. They are invalid as subnet masks but valid in access lists, and this tool allows them rather than refusing.
Take this with you
How this calculation works
A wildcard mask is the bitwise inverse of a subnet mask: where the subnet mask has a 1, the wildcard has a 0, and vice versa. Cisco access lists and OSPF network statements take the wildcard form. Enter either a mask, a wildcard or a prefix and this returns all three.
What the results mean
- Wildcard mask
- The form Cisco ACLs expect. A 0 bit means "this bit must match", a 1 bit means "ignore this bit" — the opposite of a subnet mask.
- Non-contiguous
- A mask whose 1-bits are not all together. Invalid as a subnet, but valid and useful in an ACL — for example, matching only odd-numbered subnets.
Common problems and fixes
- I entered a wildcard and got the mask, or vice versa
- The tool decides which you entered from the leading bits — subnet masks start with 1s, wildcards with 0s — and shows both forms either way, so the answer is there regardless.
- My ACL mask is "invalid"
- It is not — it is non-contiguous, which this tool allows. A prefix length is shown as "non-contiguous" because such a mask does not correspond to a standard subnet, but it is legitimate in an access list.
Frequently asked questions
Why do Cisco ACLs use wildcard masks instead of subnet masks?
Historical design, but it has a practical upside: because the bits are independent, a wildcard can match patterns a subnet mask cannot, such as every odd subnet or a specific host bit across ranges. The inverted meaning trips people up constantly, which is why a converter helps.
What is the wildcard for a single host?
0.0.0.0 — every bit must match. The subnet-mask equivalent is 255.255.255.255, or /32. To match any host, the wildcard is 255.255.255.255.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/wildcard-mask-calculator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="Wildcard Mask Calculator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/wildcard-mask-calculator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.