Wildcard Mask Calculator
A wildcard mask is the inverse of a subnet mask. Enter a CIDR prefix or a subnet mask to get the wildcard, the subnet mask, and the number of addresses in the block. In a Cisco IOS access list, 0 means the bit must match and 1 means the bit is ignored.
ACL example
For 192.168.10.32/27 the subnet mask is 255.255.255.224 and the wildcard is 0.0.0.31. The block holds 32 addresses. An ACL that should match the block uses the network address 192.168.10.32 with wildcard 0.0.0.31. It matches all 32 addresses, not only the usable hosts.
access-list 10 permit 192.168.10.32 0.0.0.31
Questions
Yes. 255.255.255.0 inverts to 0.0.0.255. The wildcard does not include the network address. You still supply that separately.
The subnet mask marks network bits with 1. The wildcard marks the bits an ACL will ignore with 1. They are inverses, and mixing them up permits the wrong traffic.
Sources
Reviewed 8 October 2026. The methodology page records what these labels do not cover.
Related tools
- Subnet Mask CalculatorConvert a prefix length and a dotted decimal mask.
- Subnet CalculatorNetwork, broadcast, mask, and usable hosts for an IPv4 address and prefix.
- IP Range CalculatorInclusive block bounds, then the usable host range.
- CIDR CalculatorStart from CIDR notation and see the exact block it names.
