IP Wildcard Calculator
Enter an IPv4 address and a subnet mask (or CIDR prefix) to calculate wildcard mask, network details, and ACL-ready values.
What is an IP wildcard mask?
A wildcard mask is the inverse of a subnet mask. In networking, wildcard masks are commonly used in Cisco ACLs (Access Control Lists), OSPF network statements, and route filtering rules. Where a subnet mask uses 1 bits to define the network portion, a wildcard mask uses 0 bits for exact matches and 1 bits for "don’t care" positions.
Example: if your subnet mask is 255.255.255.0, the wildcard mask is 0.0.0.255.
This means the first three octets must match exactly, and the last octet can vary.
Why wildcard masks matter
- ACL precision: You can define exactly which hosts or subnets are allowed/denied.
- Routing control: OSPF and other configurations use wildcard masks to select interfaces/networks.
- Troubleshooting: Quickly spotting wildcard errors can fix broken access rules.
- Exam readiness: CCNA/CCNP learners frequently see wildcard conversion problems.
Subnet mask vs wildcard mask
Quick conversion rule
For each octet, subtract subnet mask from 255:
- 255 → 0
- 254 → 1
- 252 → 3
- 248 → 7
- 240 → 15
- 224 → 31
- 192 → 63
- 128 → 127
- 0 → 255
So 255.255.252.0 becomes 0.0.3.255.
How to use this calculator
- Enter a valid IPv4 address (like
10.10.5.129). - Enter either subnet mask (
255.255.255.192) or prefix (/26or26). - Click Calculate.
- Copy the wildcard result into your ACL or routing command.
Practical examples
Example 1: Whole /24 network
Network: 192.168.1.0/24
Wildcard: 0.0.0.255
ACL style: access-list 10 permit 192.168.1.0 0.0.0.255
Example 2: Single host match
To match exactly one IP (172.16.4.10), use wildcard 0.0.0.0:
access-list 15 permit 172.16.4.10 0.0.0.0.
This is equivalent to using the host keyword in many Cisco commands.
Example 3: /27 subnet
Subnet mask 255.255.255.224 inverts to wildcard 0.0.0.31.
A statement could look like:
network 10.1.2.64 0.0.0.31 area 0.
Common mistakes to avoid
- Using subnet mask where wildcard mask is expected.
- Entering non-contiguous masks like
255.0.255.0(invalid for CIDR logic). - Forgetting that wildcard
0means exact match, not "any". - Miscalculating network boundaries for /30, /31, and /32.
FAQ
Can I input CIDR directly?
Yes. You can type /24 or 24, and the calculator converts it automatically.
Does this support IPv6 wildcard masks?
No. This tool is focused on IPv4 wildcard/subnet calculations.
What happens with /31 and /32?
The calculator reports modern usage for these prefixes. /31 is commonly used for point-to-point links, and /32 is a single host route.