NetKit

Wildcard mask calculator

Turn a subnet mask or prefix into a wildcard (inverse) mask, or the other way round, and get ready-to-paste Cisco ACL and OSPF lines.

Wildcard mask
Wildcard mask0.0.15.255
Subnet mask255.255.240.0 (/20)
Wildcard binary00000000.00000000.00001111.11111111
Matches4,096 addresses

Cisco IOS

access-list 10 permit 10.10.16.0 0.0.15.255
ip access-list extended ALLOW-NET
 permit ip 10.10.16.0 0.0.15.255 any
router ospf 1
 network 10.10.16.0 0.0.15.255 area 0

Wildcard masks vs subnet masks

PrefixSubnet maskWildcard
/8255.0.0.00.255.255.255
/16255.255.0.00.0.255.255
/20255.255.240.00.0.15.255
/22255.255.252.00.0.3.255
/23255.255.254.00.0.1.255
/24255.255.255.00.0.0.255
/25255.255.255.1280.0.0.127
/26255.255.255.1920.0.0.63
/27255.255.255.2240.0.0.31
/28255.255.255.2400.0.0.15
/29255.255.255.2480.0.0.7
/30255.255.255.2520.0.0.3
/32255.255.255.2550.0.0.0

Router ACLs compare a packet's address with the ACL address only on bits where the wildcard is 0. That's why the inverse is used: it describes what to ignore. The full table of every prefix is on the subnet cheat sheet.

Questions people ask

What is a wildcard mask?
The bitwise inverse of a subnet mask, used by Cisco ACLs and OSPF/EIGRP network statements. A 0 bit means "must match", a 1 bit means "don't care". 255.255.255.0 becomes 0.0.0.255.
How do I calculate a wildcard mask quickly?
Subtract each octet of the subnet mask from 255. For 255.255.240.0: 255−255, 255−255, 255−240, 255−0 = 0.0.15.255.
Can wildcard masks be non-contiguous?
Yes, unlike subnet masks. 0.0.254.255 on 10.0.1.0 matches every odd third octet (10.0.1.x, 10.0.3.x…). It's legal in ACLs but hard to read; this calculator flags non-contiguous masks.
What do "host" and "any" mean in an ACL?
host 10.1.1.1 is shorthand for wildcard 0.0.0.0 (match exactly one address); any is 0.0.0.0 255.255.255.255 (match everything).