Wildcard Mask Calculator

Calculate wildcard masks from subnet masks and CIDR notation for Cisco ACL and OSPF configuration.

Tested tool guide Tested browser tools Checked August 16, 2026

What Wildcard Mask Calculator does, with a checked example

This tool inverts a subnet mask, octet by octet, to produce the wildcard mask Cisco IOS expects in access control list and OSPF network statements. Enter a dotted subnet mask (255.255.255.0) or a CIDR prefix (/24) and it returns the complementary wildcard (0.0.0.255). The detail that trips people up: wildcard mask bits mean the opposite of subnet mask bits - a 0 means 'must match this bit', a 1 means 'ignore this bit' - so a wildcard of 0.0.0.0 matches exactly one host, not every host, which is backwards from how a 0.0.0.0 subnet mask would read.

Worked example

A concrete input and expected output from the current implementation.

Input

255.255.255.224

Expected output

0.0.0.31

Each octet of the wildcard mask is 255 minus the matching subnet mask octet: 255-255=0 for the first three octets, and 255-224=31 for the last, since /27 leaves 5 host bits (2^5-1=31).

How the result is produced

Octet-wise inversion

Each octet of the wildcard mask is computed as 255 minus the corresponding subnet mask octet, equivalent to a bitwise NOT of the full 32-bit mask. A CIDR prefix such as /20 is first expanded to its dotted subnet mask (255.255.240.0), then inverted the same way to give 0.0.15.255.

Contiguous mask assumption

The conversion assumes a standard, contiguous subnet mask where all 1-bits sit to the left. Cisco IOS also accepts discontiguous wildcard masks for advanced ACL matching, such as targeting only even-numbered hosts, but those masks don't correspond to any subnet mask, so this tool cannot produce or reverse them.

Good uses

writing a Cisco extended or standard ACL permit/deny line that needs a wildcard mask instead of the subnet mask you already have on hand
entering a network statement under router ospf, which requires wildcard masks rather than subnet masks in the configuration syntax
checking an unfamiliar wildcard mask copied from an existing running-config to see what address range it actually covers before editing it

Limits and checks

Only handles contiguous masks - a discontiguous wildcard mask taken from a real ACL, used to match non-adjacent hosts, will not round-trip through this tool correctly.
0.0.0.0 as a wildcard mask means match one exact address, the reverse of what 0.0.0.0 means as a subnet mask, which is easy to misread if you're used to subnet mask conventions.
The tool converts the mask itself but doesn't check that the network address you plan to pair it with is properly aligned to that block size; a /23 wildcard of 0.0.1.255 only behaves correctly against an evenly-aligned network address.

Common questions

Is a wildcard mask just an inverted subnet mask?

For any standard, contiguous subnet mask, yes - flipping every bit of the subnet mask gives the wildcard mask, and that's exactly what this tool computes. They diverge only for the discontiguous, non-standard wildcard masks IOS permits in some ACL entries, which aren't derived from a subnet mask at all.

Can I paste in a wildcard mask and get the subnet mask or CIDR prefix back?

The tool is described as calculating wildcard masks from subnet masks and CIDR notation, meaning the conversion runs in that direction. If reverse input isn't offered, you can invert it yourself by subtracting each octet from 255 to recover the subnet mask, then count the leading 1-bits for the prefix length.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.