IP lookUp IP lookUp

Wildcard Mask Calculator

Enter a CIDR prefix length, a netmask, or a Cisco-style wildcard mask, and this calculator instantly returns all three equivalent forms plus a ready-to-paste access-list and OSPF network statement — computed entirely in your browser, with nothing ever sent to a server.

Wildcard Mask Calculator

This page is for a network engineer writing or reading a Cisco IOS access control list (ACL) or an OSPF network statement, where addresses are matched using a wildcard mask instead of an ordinary netmask. A wildcard mask is the bitwise complement of a netmask: wherever the netmask has a 1 bit (meaning "this bit must match exactly"), the wildcard mask has a 0; wherever the netmask has a 0 (meaning "any value here belongs to the same subnet"), the wildcard mask has a 1 (meaning "don't care, match anything"). /24's netmask 255.255.255.0 becomes wildcard mask 0.0.0.255 — the two are the same 32 bits, simply inverted.

Why did Cisco invert the mask instead of reusing the ordinary netmask directly? Wildcard masks predate CIDR-style ACL matching and were designed to also express discontiguous, non-prefix-shaped match patterns — mask bits don't have to be a single contiguous run the way a netmask's do. A wildcard mask like 0.0.0.254 (matching only even-numbered last octets) or one with 1 bits scattered in the middle of the mask has no netmask or CIDR-prefix equivalent at all. This calculator deliberately supports only the common, contiguous case — the one that DOES have a prefix-length equivalent — since that covers essentially every real ACL and OSPF line; a genuinely discontiguous wildcard is reported as invalid on the netmask/prefix tabs rather than silently misconverted.

A worked example: "access-list 10 permit 10.0.0.0 0.0.0.255" permits any source address whose first 3 octets are exactly 10.0.0 and whose last octet is anything 0–255 — the same set of 256 addresses a /24 netmask would describe, just phrased as "match this, ignore that" instead of "this many leading bits must be identical". ACL entries are evaluated top-to-bottom with an implicit deny at the end of the list, so a wildcard mask that's broader than intended (an extra 1 bit where a 0 was meant) silently permits far more traffic than planned — one of the most common real ACL misconfigurations, and part of why double-checking the wildcard-mask arithmetic by hand (or with a calculator like this one) before deploying a change is worth the extra minute.

OSPF's "network 10.0.0.0 0.0.0.255 area 0" statement uses the identical wildcard-mask syntax to say "enable OSPF on any interface whose address falls in this range and place it in area 0" — the same inverted-mask logic, a different Cisco config context. Both example lines above update live from whatever prefix, netmask or wildcard mask you enter in the calculator, using 10.0.0.0 as a familiar private-range placeholder network so the lines are ready to adapt to your own addressing.

Glossary

Wildcard mask
The bitwise complement of a netmask, used in Cisco IOS ACLs and OSPF network statements — a 0 bit means "must match", a 1 bit means "don't care".
Netmask (subnet mask)
A dotted-decimal number (255.255.255.0) whose 1 bits mark the network portion of an address — the ordinary complement of a wildcard mask.
Access control list (ACL)
An ordered list of permit/deny rules a Cisco device evaluates top to bottom against traffic; unmatched traffic falls through to an implicit deny at the end.
Discontiguous wildcard mask
A wildcard mask whose 1 bits aren't a single contiguous run (e.g. 0.0.0.254) — has no netmask or CIDR-prefix equivalent, and is not supported by this calculator's netmask/prefix tabs.
OSPF network statement
A router-config line ("network <address> <wildcard> area <id>") that enables OSPF on any interface whose address matches the given address/wildcard pair, in the given area.
Implicit deny
Every Cisco ACL ends with an unwritten "deny all" rule — traffic that doesn't match any explicit permit line is dropped by default.

Frequently asked questions

Why is a wildcard mask the inverse of a netmask?
Cisco's ACL matching predates CIDR-style prefix matching and was designed around "match this bit / ignore that bit" logic rather than "this many leading bits are the network". Inverting the mask lets the same syntax also express non-contiguous match patterns that a plain netmask can't represent.
Can every wildcard mask be converted to a netmask?
No — only a contiguous wildcard mask (its 1 bits form a single run) has a netmask/prefix equivalent. A discontiguous mask like 0.0.0.254 is valid in an ACL but has no CIDR prefix; this calculator reports those as invalid rather than guessing at a nearest match.
What happens if my wildcard mask is wider than I meant?
An extra 1 bit in a wildcard mask makes the rule match more addresses than intended, since a 1 bit means "don't care". Because ACLs evaluate top-to-bottom with an implicit deny at the end, an overly broad permit rule can silently allow traffic that should have been denied — a common real-world ACL misconfiguration.
Is a wildcard mask the same thing as a netmask used backwards?
For the common contiguous case, yes — bit-for-bit, a wildcard mask is exactly a netmask with every bit flipped. The distinction matters mainly for the discontiguous patterns a netmask can never represent, and for remembering which meaning ("must match" vs "don't care") applies to a 0 bit in each.
Does this tool send my subnet or ACL plan anywhere?
No. Every calculation on this page — the prefix/netmask/wildcard conversion and the example ACL/OSPF lines — runs entirely in your browser using plain arithmetic; nothing you type here is sent to our servers or anywhere else.
What's the wildcard mask for /0 and /32?
/0 (match everything) has wildcard mask 255.255.255.255 — every bit is "don't care". /32 (match exactly one address) has wildcard mask 0.0.0.0 — every bit must match exactly, the opposite extreme.

API equivalent

The mask math above is computed entirely on your device — this page makes zero network requests to calculate any result on it. If you'd rather get network/prefix facts about a real, routable IP address server-side as part of a larger lookup, the network group of our main API returns the same kind of facts:

curl 
curl "https://ip.xakki.pro/api/v1/ip?ip=10.0.0.1&include=network"

Example response (trimmed):

{
  "schemaVersion": 15,
  "status": "ok",
  "ip": "10.0.0.1",
  "version": 4,
  "flags": {
    "isPrivate": true
  }
}

Read the full API docs

Like this tool? Our API gives free accounts 1,000 requests/day.See the API docs →