SubnetKit › Wildcard Mask Calculator
Wildcard Mask Calculator: how it works
Cisco access lists, OSPF and EIGRP network statements take a wildcard mask rather than a subnet mask. A 0 bit means "must match", a 1 bit means "ignore", so the wildcard is simply the bitwise inverse of the subnet mask: 255.255.255.255 minus the mask, octet by octet.
SubnetKit shows the wildcard next to the subnet mask for every calculation, and its free-form input accepts the address wildcard syntax straight from an IOS config. It is free and runs in the browser.
Worked example: 172.16.32.0/20
- Subnet mask: 255.255.240.0
- Wildcard mask: 0.0.15.255 (255 − 255 = 0, 255 − 255 = 0, 255 − 240 = 15, 255 − 0 = 255)
- Address range covered: 172.16.32.0 – 172.16.47.255 (4,096 addresses)
The same block in IOS syntax:
access-list 10 permit 172.16.32.0 0.0.15.255router ospf 1 then network 172.16.32.0 0.0.15.255 area 0
To match a single host use wildcard 0.0.0.0, or the host keyword; to match everything use 0.0.0.0 255.255.255.255, or any. Paste 172.16.32.0 0.0.15.255 into SubnetKit's quick-entry box and it is parsed as /20 automatically.
Reference: prefix, mask and wildcard
- /8 255.0.0.0 → 0.255.255.255
- /16 255.255.0.0 → 0.0.255.255
- /20 255.255.240.0 → 0.0.15.255
- /24 255.255.255.0 → 0.0.0.255
- /25 255.255.255.128 → 0.0.0.127
- /26 255.255.255.192 → 0.0.0.63
- /27 255.255.255.224 → 0.0.0.31
- /28 255.255.255.240 → 0.0.0.15
- /30 255.255.255.252 → 0.0.0.3
- /32 255.255.255.255 → 0.0.0.0
Wildcards are not limited to contiguous ones. In an ACL, 0.0.1.0 would match every even-numbered or odd-numbered third octet, a trick occasionally used to match alternate subnets in one line. Such discontiguous masks are legal in ACLs but not in OSPF.
Frequently asked questions
How do I calculate a wildcard mask?
Subtract each octet of the subnet mask from 255. For 255.255.255.192 the result is 0.0.0.63.
Is a wildcard mask the same as an inverse mask?
Yes. Cisco documentation uses both terms for the bitwise complement of the subnet mask.
Why does OSPF use wildcard masks?
The network statement originally reused ACL matching logic, which tests address bits selectively. Modern IOS also accepts a subnet mask here and converts it, but exams still expect the wildcard form.
What wildcard matches a single host?
0.0.0.0, meaning every bit must match. In ACLs you can write host 10.1.1.5 instead of 10.1.1.5 0.0.0.0.
Looking for the full guide, tips and the complete FAQ? Read the main SubnetKit page.