| IP Address | |
| Network / CIDR | |
| Subnet Mask | |
| Wildcard Mask | |
| Broadcast | |
| First Usable Host | |
| Last Usable Host | |
| Usable Hosts |
| Wildcard | CIDR | Subnet Mask | Hosts | Common Use |
|---|
A subnet mask marks the network bits with binary 1s. A wildcard mask does the reverse: it marks the variable host bits with binary 1s. Because of this, a wildcard mask is often called an inverse mask.
For example, the subnet mask 255.255.255.0 becomes the wildcard mask 0.0.0.255. In Cisco ACL syntax, this can match every host in a /24 network. A host-specific ACL normally uses 0.0.0.0 because no bits are allowed to vary.
This converter is useful when building Cisco access lists, route maps, NAT rules, object groups or documentation where one system uses CIDR notation and another expects wildcard notation.
Is a wildcard mask the same as a subnet mask? No. It is the inverse of the subnet mask. Subnet masks identify fixed network bits; wildcard masks identify bits that may change.
What wildcard matches one host? Use 0.0.0.0 for a single host match.
What wildcard matches a /24 network? A /24 network uses subnet mask 255.255.255.0 and wildcard mask 0.0.0.255.
Understanding CIDR and Wildcard Masks
CIDR (Classless Inter-Domain Routing) notation expresses a network address and its prefix length together, for example 192.168.1.0/24. The prefix length tells you how many bits are the network portion. A /24 means the first 24 bits are fixed, leaving 8 bits for host addresses. This gives you 256 total addresses (2 to the power of 8) with 254 usable hosts after reserving the network and broadcast addresses.
Cisco wildcard masks work as the bitwise inverse of a subnet mask. Where a subnet mask uses 1s to indicate network bits, a wildcard mask uses 1s to indicate the bits that are free to vary (host bits). A /24 subnet mask is 255.255.255.0 in dotted decimal, which makes the wildcard mask 0.0.0.255. In a Cisco access control list, a wildcard bit of 0 means "must match" and a bit of 1 means "ignore this bit".
This tool converts in both directions. Enter a CIDR prefix and get the wildcard, or enter a wildcard mask and find the CIDR prefix. It also generates ready-to-paste Cisco IOS syntax for standard ACLs, extended ACLs and OSPF network statements, which is particularly useful when configuring routers or switches under time pressure.
Worked Examples
Network: 192.168.1.0/24
Subnet mask: 255.255.255.0
Wildcard: 0.0.0.255
Cisco ACL: permit ip 192.168.1.0 0.0.0.255 any
Network: 10.0.0.0/30
Subnet mask: 255.255.255.252
Wildcard: 0.0.0.3
Usable hosts: 2 (point-to-point)
network 10.10.0.0 0.0.255.255 area 0
(matches all /16 addresses in 10.10.x.x)
Common Use Cases
- Cisco ACL configuration. Standard and extended ACLs require wildcard masks, not subnet masks. Use this converter to get the correct wildcard for any prefix length without manual binary arithmetic.
- OSPF and EIGRP network statements. The network command under a routing process uses wildcard mask syntax to specify which interfaces participate in the routing protocol.
- Security policy documentation. Convert between CIDR and wildcard when documenting firewall rules that mix both formats across different vendors.
- CCNA and CCNP exam preparation. Wildcard mask conversion is a core subnetting skill tested in Cisco certification exams. Use this tool to verify your manual calculations.