IP Addressing

Wildcard Mask

Paste a mask (255.255.255.0), a CIDR (/24) or a wildcard (0.0.0.255) — it is auto-detected — and get the wildcard, the mask, the CIDR and the binary of the 32 bits. With an optional network it builds the Cisco ACL and OSPF examples. Nothing is sent to any server.

redzilla.cl — wildcard

Wildcard 0.0.0.255

Mask 255.255.255.0

CIDR /24

Binary of the 32 bits

bits set to 1 bits set to 0

Configuration examples

Type a network above to use it in the commands.

What the wildcard is · how it is calculated

1. The wildcard (or inverse mask) is the bitwise NOT of the network mask: per octet, 255 − octet.

2. A 0 bit in the wildcard means "must match"; a 1 bit means "don't care". It is the opposite of the mask.

3. Cisco uses the wildcard in ACLs and in OSPF (network <network> <wildcard> area 0).

4. A valid mask has the 1s followed by the 0s (contiguous); the CIDR (/n) is the number of bits set to 1. A non-contiguous wildcard is legal in an ACL but does not map to a CIDR.

Runs locally in your browser · no sign-up · nothing leaves your browser.

How it works

The tool converts between the three ways of writing an IPv4 mask: dotted-decimal mask (255.255.255.0), CIDR prefix (/24) and wildcard or inverse mask (0.0.0.255). You paste any of the three and it autodetects the format, showing the other two along with the full 32-bit binary of both the mask and the wildcard. If you also provide a network address, it generates ready-to-copy example commands: a standard Cisco ACL and the OSPF network statement.

The math is a bitwise NOT: the wildcard is the complement of the mask, which per octet equals 255 − octet. In a wildcard a 0 bit means «must match» and a 1 bit means «do not care», exactly the opposite of the mask. The tool validates that the mask is contiguous (all the 1s followed by all the 0s, the condition for a CIDR prefix to exist) and, if you paste a non-contiguous wildcard, it warns that it is legal in an ACL but does not map to any /n.

Example: the wildcard of a /26 for an ACL

Input /26: the mask has 26 bits set to 1, that is 255.255.255.192.
Wildcard per octet: 255−255, 255−255, 255−255, 255−192 → 0.0.0.63.
With network 192.168.1.0 the tool generates access-list 10 permit 192.168.1.0 0.0.0.63 and network 192.168.1.0 0.0.0.63 area 0.

Frequently asked questions

What is the wildcard of a /24, a /26 and a /30?

A /24 (mask 255.255.255.0) has wildcard 0.0.0.255; a /26 (255.255.255.192), 0.0.0.63; and a /30 (255.255.255.252), 0.0.0.3. The rule is always the same: subtract each mask octet from 255, or equivalently, the wildcard has as many ones as the prefix has host bits.

Why do Cisco ACLs and OSPF use a wildcard instead of a mask?

Because the matching logic is inverted: a 0 bit in the wildcard forces that address bit to match, while a 1 bit ignores it. That allows rules more flexible than a prefix, such as matching by parity or non-aligned ranges. In IOS it is used by standard and extended ACLs and by the network command of OSPF and EIGRP; interfaces, on the other hand, are configured with the normal mask.

What happens if my wildcard is not contiguous, for example 0.0.255.0?

It is still valid in an ACL: it means «octets 1, 2 and 4 must match, the third one is ignored». But it does not map to any CIDR prefix, because the ones and zeros do not form a single block, and the tool flags it with a warning showing CIDR «not applicable». Modern IOS accepts it, although it is worth documenting why it is used.

Does the calculator send my networks to any server?

No. The format detection, the bitwise NOT and the command generation all run entirely in your browser, with no sign-up and no external calls. You can use it with internal or customer network addresses without exposing any data.

Was this tool useful?

Disclaimer

We take great care to keep every tool accurate and review it thoroughly; even so, we can't guarantee it is free of errors or take responsibility for how the results are used. We recommend double-checking anything critical.

Found an error? Let us know →