Wildcard Mask Calculator
Convert a subnet mask into its wildcard mask equivalent for ACLs and OSPF.
About Wildcard Mask Calculator
A wildcard mask is the bitwise inverse (NOT) of a subnet mask: every 0 bit in the subnet mask becomes a 1, and every 1 becomes a 0. Equivalently, wildcard = 255.255.255.255 − subnet mask. Cisco IOS access control lists (ACLs) and OSPF network statements use wildcard masks instead of subnet masks to define which address bits must match (0) and which are 'don't care' (1).
Formula
Wildcard from subnet mask
wildcard = 255.255.255.255 − subnet_mask
- mask
- The subnet mask in dotted-decimal form
Worked example
With the default values below, Wildcard Mask Calculator returns Wildcard Mask of 0.0.0.255. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Subnet Mask
- 255.255.255.0
Results
- Wildcard Mask
- 0.0.0.255
- Subnet Mask
- 255.255.255.0
- Equivalent CIDR Prefix
- /24
- Binary Wildcard Mask
- 00000000.00000000.00000000.11111111
Step by step
- 1Values used
- 2Wildcard from subnet mask
- 3Wildcard Mask= 0.0.0.255
- 4Subnet Mask= 255.255.255.0
- 5Equivalent CIDR Prefix= /24
- 6Binary Wildcard Mask= 00000000.00000000.00000000.11111111
Assumptions and limits
- The result is derived only from the single input listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why do routers use wildcard masks instead of subnet masks?
ACLs and some routing protocol configurations (like OSPF network statements) were designed with wildcard mask syntax so administrators can specify 'match' bits (0) versus 'ignore' bits (1) explicitly, which is more flexible than a strict subnet mask for defining discontiguous ranges.
How do I convert a wildcard mask back to a subnet mask?
Apply the same inversion again — subtract each octet from 255 (or 255.255.255.255 as a whole). Inverting a wildcard mask returns the original subnet mask.
Can a wildcard mask have non-contiguous bits?
Yes — unlike subnet masks, wildcard masks used in ACLs can have discontiguous 1-bits to match unusual address patterns, though this calculator assumes a standard contiguous mask input.