Wildcard Mask Calculator

A subnet mask answers “which bits identify the network?” and a wildcard mask answers the opposite question, “which bits may vary?”. Access lists and routing configuration on Cisco-style devices use wildcards, so anyone writing them has to flip masks in their head. This page converts between mask, wildcard and prefix length and produces ready-to-adapt configuration lines.

What a wildcard means

The rule is simple. Where the wildcard has a 0 bit, the corresponding bit of the address must match exactly. Where it has a 1 bit, the bit is ignored. A subnet mask is the other way around, ones for the fixed part. So the wildcard is the inverse of the mask: 255.255.255.0 becomes 0.0.0.255, 255.255.255.192 becomes 0.0.0.63, and a /23 mask 255.255.254.0 becomes 0.0.1.255. Subtract each mask octet from 255 and you have it. The number of addresses a wildcard matches is two to the power of its one bits, which the page shows alongside.

Three ways to enter a value

Choose subnet mask, wildcard mask or prefix length and type the value; the other two are filled in. A network address field adds the lines for configuration. If the network address does not line up with the mask, for example 192.168.1.0 with a /23 mask where the network would be 192.168.0.0, the page shows a note: access lists ignore the bits the wildcard marks as don’t-care, so the line still works, but the normal practice is to write the network address with those host bits cleared.

The generated lines

For the sample the page produces three lines you can adapt. A numbered standard access list entry: access-list 10 permit 192.168.1.0 0.0.1.255. A named extended entry: permit ip 192.168.1.0 0.0.1.255 any. And an OSPF network statement: network 192.168.1.0 0.0.1.255 area 0. The access list number, action, protocol and area are placeholders for your policy, and the page says so, since the right values depend on what you want to permit or deny and where the list is applied.

Non-contiguous wildcards

Subnet masks must be a run of ones then zeros, but wildcards do not have to be. Network engineers exploit that to match patterns, for example every even-numbered subnet or the same host in many VLANs. When you enter one, the page reports “not contiguous: no single prefix” for the prefix length and shows a warning that the wildcard is valid in an access list but cannot be written as a subnet. Use this only if your device’s documentation supports it for the feature you are configuring.

A worked example

Enter the mask 255.255.254.0. The wildcard is 0.0.1.255, in binary 00000000.00000000.00000001.11111111; the prefix is /23 and the wildcard matches 512 addresses. With the network address 192.168.1.0 the page prints the three lines above and adds the host-bits note, because 192.168.1.0 is inside 192.168.0.0/23.

Limits

The page does arithmetic and generates text; it does not connect to equipment or check your configuration. Syntax varies between vendors and software versions. Always test access lists in a lab or with a rollback plan, as a wrong wildcard can lock you out.

Related tools

• Subnet Calculator gives network, broadcast and host range for the same mask.
• IP to Binary Converter shows the bits that a wildcard matches.
• Route Summarization Calculator combines networks into one statement.
• Broadcast Address Calculator calculates network and broadcast for many addresses at once.