Wildcard Mask Calculator
Convert a subnet mask to its wildcard mask (inverse mask) for ACLs and OSPF configuration.
Inputs
Dotted-decimal subnet mask, e.g. 255.255.255.0
Wildcard Mask
0.0.0.255
Subnet Mask
255.255.255.0
Equivalent CIDR Prefix
/24
Binary Wildcard Mask
00000000.00000000.00000000.11111111
Step by step
Values used
Subnet Mask = 255.255.255.0
Wildcard from subnet mask
wildcard = 255.255.255.255 − subnet_mask
Wildcard Mask
= 0.0.0.255
Subnet Mask
= 255.255.255.0
Equivalent CIDR Prefix
= /24
Binary Wildcard Mask
= 00000000.00000000.00000000.11111111
How it works
A wildcard mask is the bitwise inverse (NOT) of a subnet mask: every 0 bit in the subnet mask becomes a 1, and every 1 becomes a 0. Equivalently, wildcard = 255.255.255.255 − subnet mask. Cisco IOS access control lists (ACLs) and OSPF network statements use wildcard masks instead of subnet masks to define which address bits must match (0) and which are 'don't care' (1).
Formula
Wildcard from subnet mask
wildcard = 255.255.255.255 − subnet_mask
- mask
- The subnet mask in dotted-decimal form
Frequently Asked Questions
Why do routers use wildcard masks instead of subnet masks?
ACLs and some routing protocol configurations (like OSPF network statements) were designed with wildcard mask syntax so administrators can specify 'match' bits (0) versus 'ignore' bits (1) explicitly, which is more flexible than a strict subnet mask for defining discontiguous ranges.
How do I convert a wildcard mask back to a subnet mask?
Apply the same inversion again — subtract each octet from 255 (or 255.255.255.255 as a whole). Inverting a wildcard mask returns the original subnet mask.
Can a wildcard mask have non-contiguous bits?
Yes — unlike subnet masks, wildcard masks used in ACLs can have discontiguous 1-bits to match unusual address patterns, though this calculator assumes a standard contiguous mask input.