Network Calculator

A wildcard mask is the bitwise inverse of a subnet mask. Where a subnet mask uses 1-bits to mark the bits that must match and 0-bits for the host portion, a wildcard mask flips that: a 0 means "this bit must match" and a 1 means "don't care, any value." A /24 subnet mask of 255.255.255.0 inverts to the wildcard 0.0.0.255 — the first three octets must match, the last octet is free to be anything.

Cisco ACLs, OSPF network statements, and several other IOS features expect wildcards rather than subnet masks. The reason is historical and practical: a wildcard can express matches a contiguous subnet mask can't, like "every odd host" or "this octet in any subnet," because its 1-bits don't have to be contiguous. For ordinary subnet-shaped matches, though, it's simply the inverse, and getting that inverse right by hand under time pressure is a classic source of misconfigured access lists.

Converting is per-octet subtraction from 255: wildcard octet = 255 − mask octet. So 255.255.255.0 gives 0.0.0.255, and 255.255.255.192 (a /26) gives 0.0.0.63. The /26 wildcard of 0.0.0.63 says the low 6 bits are don't-care, which is exactly the 64-address span of a /26. This calculator does the three-way conversion between CIDR prefix, dotted subnet mask, and wildcard mask, and shows the mask in binary so you can see the bit boundary directly.

A practical caution: an ACL wildcard and a route's subnet mask describe the same boundary from opposite directions, and mixing them up is the bug that quietly permits or denies the wrong range. If you write a subnet mask where IOS wants a wildcard, 255.255.255.0 becomes a match on a single host plus a scatter of others rather than a whole /24. When a rule isn't behaving, inverting the mask is the first thing to check.