HesapHanem

Wildcard Mask Calculator

Enter a subnet mask to get its wildcard mask.

How it is calculated

You enter a subnet mask in dotted-decimal form, four numbers from 0 to 255 separated by dots. The tool subtracts each number from 255: wildcard octet = 255 − mask octet. Because each octet is 8 bits, this is the same as flipping every bit of the mask, so the 1-bits of the netmask become 0 and the 0-bits become 1. In a wildcard mask a 0 means "this bit must match" and a 1 means "this bit may be anything". The tool checks only the format, which must be exactly four dot-separated numbers, each at most 255. It does not check that the mask is a valid contiguous prefix, so 255.0.255.0 is converted too (to 0.255.0.255). A prefix length such as /24 is not accepted; convert it to dotted form first.

Worked example

Take the mask 255.255.248.0, which is a /21 network. Subtract each octet from 255: 255 − 255 = 0, 255 − 255 = 0, 255 − 248 = 7 and 255 − 0 = 255. The tool shows 0.0.7.255. In an ACL, this wildcard means the first two octets must match exactly, the third octet may vary in its lowest three bits (a range of 8 values) and the last octet may be anything. That covers 8 × 256 = 2,048 addresses.

Try this example →

Common mistakes

  • Typing the prefix length (/21) instead of the dotted mask. Only the four-number dotted form is accepted, so /21 must be written as 255.255.248.0.
  • Entering a wildcard mask in the field and expecting a subnet mask back. The conversion is its own inverse, so 0.0.7.255 returns 255.255.248.0, but it is easy to lose track of which is which.
  • Using the wildcard where a netmask is needed. Routing tables and interface settings take 255.255.248.0, while ACL and OSPF network statements take 0.0.7.255.
  • Assuming the tool validates the mask. A non-contiguous mask such as 255.0.255.0 is converted without warning, even though it is not a normal subnet mask.
  • Forgetting that the network address in the ACL line must match the mask boundary. The wildcard alone does not choose the address range, the address you pair it with does.

About this calculator

This calculator converts a standard dotted-decimal subnet mask into its wildcard mask — the exact inverse, computed octet by octet as 255 − mask octet (so a /24 mask of 255.255.255.0 becomes the wildcard 0.0.0.255).

Wildcard masks flip the logic of a normal netmask: a 0 bit means "must match" and a 1 bit means "don't care," the opposite of a subnet mask. Network engineers use them specifically because Cisco IOS access control lists (ACLs) and the OSPF routing protocol require addresses to be specified in wildcard form rather than standard mask form.

Was this helpful?

You can pick up to 3 reactions.

Comments (1)

  • Editorial team

    Wildcard masks do not have to be contiguous, which is why this converter accepts odd input. Entering 255.0.255.0 returns 0.255.0.255, and on a router an ACL line using that pattern can match the same host numbers across many networks. For ordinary subnets, 255.255.255.252 gives 0.0.0.3 and 255.255.255.0 gives 0.0.0.255. Which platform are you writing the ACL for, and do you use non-contiguous patterns on purpose?

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators