This wildcard mask calculator converts subnet masks and CIDR prefixes into the inverse (wildcard) masks Cisco ACLs and OSPF network statements use, and tests which addresses an address/wildcard pair matches. It runs entirely in your browser: nothing you type is sent to our server.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
What a wildcard mask is
A wildcard mask is the inverse of a subnet mask: a 0 bit means “must match” and a 1 bit means “ignore”. /24 = subnet mask 255.255.255.0 = wildcard 0.0.0.255. Subtract each octet of the subnet mask from 255 to get the wildcard.
| Prefix | Subnet mask | Wildcard |
|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 |
| /16 | 255.255.0.0 | 0.0.255.255 |
| /22 | 255.255.252.0 | 0.0.3.255 |
| /24 | 255.255.255.0 | 0.0.0.255 |
| /30 | 255.255.255.252 | 0.0.0.3 |
| /32 | 255.255.255.255 | 0.0.0.0 (host) |
Non-contiguous wildcards
ACL wildcards do not have to be contiguous. 10.1.0.1 0.255.0.255 matches every address whose first octet is 10 and third octet is 0, for example one address per site in a 10.x.0.y scheme. The calculator counts the matches and tests any IP you enter.
IP ranges in ACLs
An ACL entry can only match a block on bit boundaries. For a range such as 10.0.0.5 – 10.0.0.20, the tool lists the address/wildcard pairs you need. To build a full ACL, use the Cisco ACL generator.
How we checked it
We checked conversions, match tests (including a non-contiguous wildcard) and range-to-wildcard results by hand on 11-12 October 2026, and the underlying range maths against Python’s ipaddress module.
Frequently asked questions
How do I calculate a wildcard mask?
Subtract each octet of the subnet mask from 255. 255.255.252.0 becomes 0.0.3.255.
What does wildcard 0.0.0.0 mean?
Every bit must match: the entry matches one host. Cisco also accepts the keyword host instead.
Can OSPF use a non-contiguous wildcard?
No. OSPF network statements need a contiguous wildcard; only ACLs accept non-contiguous ones.