Wildcard mask calculator
Convert a subnet mask into the wildcard mask that Cisco access lists and OSPF use, and see the matching prefix. Non-contiguous masks are handled too.
The wildcard mask is the bitwise inverse, used in Cisco access lists.
Wildcard masks are subnet masks, inverted
When you write an access list on a Cisco device, you do not use the subnet mask directly. You use its inverse, the wildcard mask. Every 0 in the wildcard means "this bit must match", and every 1 means "do not care". So to match the whole 198.51.100.0/24 network you write 198.51.100.0 with the wildcard 0.0.0.255.
The conversion is simple: subtract each octet of the subnet mask from 255. 255.255.255.0 becomes 0.0.0.255; 255.255.255.252 becomes 0.0.0.3. Because wildcard masks can also be non-contiguous, they can match patterns a subnet mask cannot, such as every fourth subnet. For the standard mask side, use the subnet mask calculator.
Frequently asked questions
What is a wildcard mask?
A wildcard mask is the bitwise inverse of a subnet mask, used in Cisco access lists and OSPF. Where a subnet mask has 1s, the wildcard has 0s. The inverse of 255.255.255.0 is 0.0.0.255.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet from 255, or flip every bit. 255.255.255.192 becomes 0.0.0.63. This tool does it instantly and shows the matching prefix.
Why do Cisco ACLs use wildcard masks?
A wildcard mask marks which bits to ignore when matching. A 0 bit means the bit must match; a 1 bit means it can be anything. That makes it flexible for matching ranges and patterns.
Can a wildcard mask be non-contiguous?
Yes. Unlike subnet masks, wildcard masks can have gaps, letting an ACL match patterns like every odd address. This tool still shows the inverse even when the input is non-contiguous.