What is a wildcard mask?
A wildcard mask (also called an inverse mask) is the bitwise complement of a subnet mask. Where a subnet mask uses a 1 bit to mean "this bit must match," a wildcard mask uses a 0 bit for the same meaning — and a 1 bit to mean "don't care." Wildcard masks are most commonly used in Cisco IOS access control lists (ACLs) and in OSPF network statements, where the device expects an inverse mask rather than a standard subnet mask.
How to use this calculator
Choose an input method. Enter a CIDR prefix length (for example 24 for a /24 network) and the calculator first derives the subnet mask, or pick "Subnet mask" and type each of the four octets directly (such as 255.255.255.0). The tool then returns the wildcard mask and shows the per-octet breakdown plus the number of addresses the mask matches.
The formula explained
The conversion is performed independently for each of the four octets:
$$\text{wildcard octet} = 255 - \text{subnet mask octet}$$
This works because each octet is an 8-bit number whose maximum value is 255 (binary 11111111). Subtracting from 255 flips every bit, producing the exact bitwise inverse.
Worked example
Take the subnet mask 255.255.255.0 (a /24 network). Apply the formula octet by octet:
$$255 - 255 = 0,\quad 255 - 255 = 0,\quad 255 - 255 = 0,\quad 255 - 0 = 255.$$
The wildcard mask is 0.0.0.255. It matches 256 addresses \((1 \times 1 \times 1 \times 256)\), which is the size of a single /24 block.
FAQ
Is a wildcard mask the same as a subnet mask? No. They are inverses of each other. A subnet mask of 255.255.255.0 corresponds to a wildcard mask of 0.0.0.255.
Why does OSPF use wildcard masks? Cisco's OSPF configuration syntax historically adopted the same inverse-mask format used by ACLs, so you specify networks with a wildcard mask rather than a subnet mask.
Can a wildcard mask be non-contiguous? Yes — unlike subnet masks, ACL wildcard masks can use non-contiguous bits to match patterns, though this calculator assumes a standard contiguous mask.
