Wildcard Mask Calculator

Convert any subnet mask to its wildcard mask (or vice versa) instantly. Enter either format and get the complementary mask, CIDR prefix length, and binary breakdown — all calculated locally in your browser.

What Is a Wildcard Mask?

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask uses 1-bits to identify the network portion and 0-bits for the host portion, a wildcard mask flips that logic — 0-bits mean "must match" and 1-bits mean "don't care." Wildcard masks are primarily used in Cisco IOS access control lists (ACLs) and OSPF area configurations.

For example, a /24 subnet mask of 255.255.255.0 has the wildcard mask 0.0.0.255. The first three octets must match exactly, while the last octet can be anything. If you're already comfortable with subnetting and CIDR notation, wildcard masks are simply the complement.

Subnet Mask vs Wildcard Mask

Understanding the relationship between these two mask types is fundamental to configuring IP networking equipment. The conversion is straightforward — subtract each octet from 255:

Pro Tip: The fastest way to compute a wildcard mask in your head is to subtract each octet of the subnet mask from 255. For 255.255.248.0, that's 0.0.7.255. No binary math required. If you need to verify, check the binary with our IP to Binary Converter.

How the Conversion Works

The mathematical operation behind the conversion is a bitwise NOT (complement). For a 32-bit subnet mask, each bit is flipped:

Subnet Mask:   255.255.255.0
Binary:        11111111.11111111.11111111.00000000
Bitwise NOT:   00000000.00000000.00000000.11111111
Wildcard Mask: 0.0.0.255

Subnet Mask:   255.255.255.192
Binary:        11111111.11111111.11111111.11000000
Bitwise NOT:   00000000.00000000.00000000.00111111
Wildcard Mask: 0.0.0.63

This operation works identically in both directions. Taking the bitwise NOT of a wildcard mask returns the original subnet mask. You can explore the binary representation of any address or mask using our IP to Binary Converter or look at hex values with the Hex IP Converter.

Where Wildcard Masks Are Used

Wildcard masks appear in several key networking contexts. If you manage routers or configure routing protocols, you'll encounter them regularly:

• Cisco IOS Access Control Lists — Standard and extended ACLs require wildcard masks to define which addresses are matched.
• OSPF Area Configuration — The network command under OSPF uses wildcard masks to specify which interfaces participate in the routing process.
• EIGRP Network Statements — Similar to OSPF, EIGRP uses wildcards in network declarations.
• BGP Network Advertisements — Some BGP configurations use wildcard notation.
• Firewall Rules — Certain firewall platforms use wildcard masks for packet matching.

Here is an example of OSPF and ACL configuration using wildcard masks:

! OSPF: advertise 192.168.1.0/24 into area 0
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

! ACL: permit traffic from 10.0.0.0/8 to any destination
access-list 10 permit 10.0.0.0 0.255.255.255

! Extended ACL: permit HTTP from 172.16.0.0/12
ip access-list extended WEB-TRAFFIC
 permit tcp 172.16.0.0 0.15.255.255 any eq 80

Notice the wildcard 0.15.255.255 for the 172.16.0.0/12 range — it covers 172.16.0.0 through 172.31.255.255. If you need to verify the exact IP range, use our IP Range Calculator.

Complete Wildcard Mask Reference Table

This table covers every standard prefix length from /8 to /32 with the corresponding subnet mask, wildcard mask, and host count. Bookmark this page for quick reference when configuring your gateway or port forwarding rules.

Common Mistakes with Wildcard Masks

Even experienced network engineers sometimes make errors when working with wildcard masks. Here are the most frequent pitfalls and how to avoid them:

When in doubt, use this calculator to verify your mask, then check the resulting network boundaries with our Subnet Calculator. You can also determine whether two hosts are on the same subnet using the Same Subnet Checker.

Wildcard Masks in Home Networking

While wildcard masks are primarily an enterprise concept, understanding them helps when configuring advanced features on home routers. If you access your router at 192.168.1.1 or 10.0.0.1 and see ACL or firewall settings, you may encounter wildcard notation. Your home network likely uses a /24 subnet (255.255.255.0), which has the wildcard mask 0.0.0.255 — meaning all 254 usable host addresses on your LAN are included.

If you're setting up a static IP or configuring DHCP reservations, knowing your wildcard mask helps you understand exactly which addresses fall within your network scope. For DNS configuration, the wildcard mask determines which clients are affected by your rules.

Video: Understanding Wildcard Masks

Related Tools and Guides

• Subnet Calculator
• CIDR Converter
• IP Range Calculator
• IP to Binary Converter
• Hex IP Converter
• Same Subnet Checker
• Network Class Identifier
• Bogon IP Checker
• What Is a Subnet Mask?
• What Is NAT?

Frequently Asked Questions

What is a wildcard mask in networking?

A wildcard mask is a 32-bit value used in Cisco IOS and other networking platforms to define which bits of an IP address must match and which can vary. It is the bitwise inverse of a subnet mask. A 0-bit means the corresponding address bit must match, and a 1-bit means it can be anything.

How do I convert a subnet mask to a wildcard mask?

Subtract each octet of the subnet mask from 255. For example, 255.255.255.0 becomes 0.0.0.255 (255-255=0, 255-255=0, 255-255=0, 255-0=255). Alternatively, perform a bitwise NOT operation on the 32-bit mask value.

Why do Cisco ACLs use wildcard masks instead of subnet masks?

Cisco ACLs use wildcard masks because they can express non-contiguous bit patterns, which provides more flexibility than subnet masks. For example, a wildcard of 0.0.0.254 matches only even-numbered hosts. While this advanced use is rare, the wildcard format supports it.

What is the wildcard mask for a /32 host route?

The wildcard mask for /32 is 0.0.0.0, meaning every bit must match exactly. In Cisco IOS, you can use the shorthand host 10.0.0.1 instead of writing 10.0.0.1 0.0.0.0. Use our Subnet Calculator to verify any prefix length.

What is the wildcard mask for "any" (all addresses)?

The wildcard mask for matching all addresses is 255.255.255.255 (all "don't care" bits). In Cisco IOS, use the keyword any as a shorthand instead of writing 0.0.0.0 255.255.255.255.

Do wildcard masks work with IPv6?

No. IPv6 ACLs in Cisco IOS use prefix-length notation (e.g., 2001:db8::/32) instead of wildcard masks. The wildcard mask concept applies only to IPv4 configurations. For IPv6 work, try our IPv6 Converter.

Can I use this calculator for OSPF network statements?

Yes. OSPF network commands require wildcard masks. Enter your subnet mask here to get the wildcard mask, then use it in your OSPF configuration. For example, if your interface is on 192.168.1.0/24, you need network 192.168.1.0 0.0.0.255 area 0.

About Tommy N.

Tommy is the founder of RouterHax and a network engineer with 10+ years of experience in home and enterprise networking. He specializes in router configuration, WiFi optimization, and network security. When not writing guides, he's testing the latest mesh WiFi systems and helping readers troubleshoot their home networks.