What is Wildcard Mask? How to Calculate It

By : Bryce Leo Bryce Leo
Hours Updated

⚡ Smart Summary

Wildcard mask is a 32-bit inverse mask that tells routers and access control lists which parts of an IP address to match and which to ignore, using zero bits to match and one bits to skip.

  • 🔄 Inverse logic: A wildcard mask reverses subnet-mask rules — a 0 bit must match the address, and a 1 bit is ignored.
  • 🧮 Calculation: Subtract the subnet mask from 255.255.255.255 to produce the matching wildcard mask.
  • 🎯 Host and any: The keyword host equals 0.0.0.0, and the keyword any equals 255.255.255.255.
  • 🛡️ ACL use: Wildcard masks define which address ranges an access control list permits or denies.
  • 🧭 Routing: OSPF and EIGRP network statements also rely on wildcard masks to select interfaces.
  • 🤖 AI assistance: AI assistants can generate and validate wildcard masks, reducing manual ACL errors.
Read More

What is Wildcard Mask and How to Calculate It

What is Wildcard Mask?

A wildcard mask is a sequence of numbers that streamlines packet routing inside a private network’s subnets. It is also referred to as an inverse mask. Unlike a subnet mask, where binary 1 means a match and binary 0 means no match, a wildcard mask reverses that logic.

A wildcard mask is 32 bits long. With a wildcard mask, the zero bits indicate that the corresponding bit position must match the same position in the IP address, while the one bits indicate that the corresponding position does not have to match.

Wildcard masks use the following rules to match binary 1 and 0:

  • If the wildcard mask bit is 0, it matches the bit value in the address.
  • If the wildcard mask bit is 1, you ignore the corresponding bit value in the address.

The wildcard mask for a single host is always 0.0.0.0.

Wildcard Mask vs Subnet Mask

Wildcard masks and subnet masks look similar but serve opposite purposes. A subnet mask separates the network portion of an address from the host portion, while a wildcard mask tells a device which address bits to match and which to ignore. The table below compares the two:

Basis Subnet Mask Wildcard Mask
Binary 1 Identifies the network bits Ignore this bit (do not care)
Binary 0 Identifies the host bits Must match this bit exactly
Purpose Defines subnet boundaries Filters addresses in ACLs and routing statements
Example for a /24 255.255.255.0 0.0.0.255
Bits must be contiguous Yes No — masks can be non-contiguous

How Does a Wildcard Mask Work?

The following example helps you understand the concept of wildcard masks. The diagram shows a network with three hosts and a router that is directly connected to three subnets:

Network diagram of a router connected to three subnets illustrating wildcard mask matching

Suppose you want to advertise only the 10.0.1.0/24 subnet. You can use the wildcard mask 0.0.0.255 in the following network command:

R1(config-router)#network 10.0.1.0 0.0.0.255

Why wildcard mask of 0.0.0.255?

First, convert the Cisco wildcard mask and IP address into binary:

10.0.1.0 = 00001010.00000000.00000001.00000000
0.0.0.255 = 00000000.00000000.00000000.11111111

The zero bits of the wildcard mask must match the same position in the IP address that is included in the network command:

00001010.00000000.00000001.00000000
00000000.00000000.00000000.11111111

In the example above, the last octet does not need to match because the wildcard bits are all ones. The first 24 bits must match because those wildcard mask bits are all zeros.

Here, the wildcard mask matches all IP addresses that begin with 10.0.1.x (10.0.1.0 to 10.0.1.255). In this case, only one network is matched: 10.0.1.0/24.

What if you want to include both 10.0.0.0/24 and 10.0.1.0/24 subnets?

You need to use the wildcard mask 0.0.1.255, as shown below:

10.0.0.0 = 00001010.00000000.00000000.00000000
10.0.1.0 = 00001010.00000000.00000001.00000000
0.0.1.255 = 00000000.00000000.00000001.11111111

With the wildcard mask 0.0.1.255, only 23 bits have to match. This means all addresses in the range 10.0.0.0 to 10.0.1.255 are matched, so both subnets are covered.

RELATED ARTICLES

How to Calculate Wildcard Mask?

Calculating a wildcard mask by hand can be a challenging task. One easy shortcut is to subtract the subnet mask from 255.255.255.255. The result is the wildcard mask.

For example:

 
1) 255.255.255.255 - 255.255.255.255 = 0.0.0.0 (wildcard mask)
2) 255.255.255.255 - 255.255.255.128 = 0.0.0.127 (wildcard mask)
3) 255.255.255.255 - 192.0.0.0 = 63.255.255.255 (wildcard mask)

Common Wildcard Mask Values

The table below lists frequently used CIDR prefixes with their matching subnet and wildcard masks, so you can look up a value instead of calculating it each time:

CIDR Subnet Mask Wildcard Mask Addresses matched
/8 255.0.0.0 0.255.255.255 16,777,216
/16 255.255.0.0 0.0.255.255 65,536
/24 255.255.255.0 0.0.0.255 256
/25 255.255.255.128 0.0.0.127 128
/26 255.255.255.192 0.0.0.63 64
/27 255.255.255.224 0.0.0.31 32
/28 255.255.255.240 0.0.0.15 16
/30 255.255.255.252 0.0.0.3 4

Wildcard Mask Keywords: host and any

Cisco IOS provides two shorthand keywords so you do not have to type common wildcard masks in an access control list:

  • host — replaces the wildcard mask 0.0.0.0 and matches one exact IP address. For example, host 10.0.1.5 is the same as 10.0.1.5 0.0.0.0.
  • any — replaces the wildcard mask 255.255.255.255 and matches every IP address. For example, any is the same as 0.0.0.0 255.255.255.255.

These keywords make ACL statements shorter and easier to read, and they reduce the chance of a typing mistake in the mask.

Where can Wildcard Masks be used?

Wildcard masks are used in access control lists (ACLs). They are useful when you have a large network and need to control traffic flow between multiple routers and LAN segments. Whenever you manage a large network with several routers, you will likely run into Cisco wildcard masks.

Wildcard masks also appear in dynamic routing protocols such as OSPF and EIGRP, where network statements use them to select the interfaces that participate in routing. You need to set your wildcard mask carefully so that only the intended traffic can pass through your router.

FAQs

Yes. OSPF and EIGRP network statements use wildcard masks to decide which interfaces belong to a routing process. For example, network 10.0.1.0 0.0.0.255 activates routing on every interface in the 10.0.1.0/24 subnet.

Yes. Unlike a subnet mask, a wildcard mask does not need contiguous bits. A mask such as 0.0.0.254 matches only even addresses in the last octet, which is useful for selecting alternating hosts in an ACL.

The term is most common on Cisco IOS, but the inverse-mask concept appears on other platforms too. Many firewalls and routers use the same match-and-ignore logic, even when they label it differently or accept a prefix length instead.

No. A wildcard mask is only matching logic used inside ACLs and routing statements. It does not modify packet contents or add measurable delay; it simply tells the device which address bits to compare.

An incorrect mask matches too many or too few addresses. Too broad a mask can permit unwanted traffic and create security holes, while too narrow a mask can block legitimate hosts. Always verify the range before applying the rule.

A CIDR prefix such as /24 is shorthand for a contiguous subnet mask. A wildcard mask like 0.0.0.255 expresses the same range for matching but can also describe non-contiguous patterns that a simple prefix cannot represent.

Yes. AI and machine-learning assistants can convert a subnet or address range into the correct wildcard mask, flag masks that are too permissive, and explain each rule in plain language. An engineer should still review the output before deployment.

GitHub Copilot can draft ACL and OSPF statements with wildcard masks from a short comment describing the target range. Always confirm the generated mask matches the intended addresses before applying it to a production device.

Summarize this post with: