What Is a Reverse Subnet Mask?
A reverse subnet mask — also called a wildcard mask — is the bitwise inverse of a standard subnet mask. Where a subnet mask uses 1s to identify the network portion of an IP address, a wildcard mask uses 0s for the bits that must match and 1s for the bits that can vary. Wildcard masks are used heavily in networking, especially in Cisco access control lists (ACLs) and OSPF configuration, where the device expects a wildcard rather than a normal mask.
This calculator takes one input — your Subnet Mask (for example, 255.255.255.0) — and instantly returns the reverse mask along with several useful related values: the CIDR prefix length, the total number of hosts, and the number of usable hosts.
How to Use the Calculator
- Subnet Mask: Enter the dotted-decimal mask you want to convert, such as
255.255.255.192. - Submit to receive the reverse (wildcard) mask, the CIDR notation, total hosts, and usable hosts.
The Formula Behind It
The tool performs four simple calculations:
$$\text{Wildcard Mask} = 255.255.255.255 - \text{Subnet Mask}$$- Wildcard mask: each octet is subtracted from 255 (\(255 - \text{octet}\)).
- CIDR prefix: the mask is converted to binary and the number of 1 bits is counted.
- Total hosts: \(2^{(32 - \text{CIDR})}\).
- Usable hosts: total hosts minus 2 (one for the network address, one for the broadcast address), with a floor of 0.
Worked Example
Suppose you enter 255.255.255.0:
- Wildcard mask: \(255-255,\ 255-255,\ 255-255,\ 255-0\) =
0.0.0.255 - CIDR: the binary form has 24 ones, so the prefix is /24
- Total hosts: $$2^{(32 - 24)} = 2^{8} = 256$$
- Usable hosts: \(256 - 2 = 254\)
Frequently Asked Questions
Why does the wildcard for /24 come out as 0.0.0.255? Because the wildcard is the exact inverse of the mask — the bits the mask locks (the network) become 0, and the host bits become 1, here covering the final 256-address octet.
Where do I actually use a wildcard mask? Most commonly in Cisco IOS access lists and OSPF network statements, which require wildcard masks instead of standard subnet masks.
Why subtract 2 for usable hosts? The first address in a subnet is reserved as the network identifier and the last as the broadcast address, neither of which can be assigned to a device.
