Wildcard Mask Calculator
Convert an IPv4 CIDR or subnet mask into a Cisco ACL wildcard and examples
A wildcard mask is the bitwise inverse of a subnet mask: 0 means match, 1 means ignore.
CIDR, subnet mask, wildcard, network range, and address count will appear here.
About this tool
Wildcard Mask Calculator accepts an IPv4 address plus a CIDR prefix or contiguous subnet mask. It normalizes the containing network, computes the inverse wildcard mask, broadcast address, traditional usable host range, and exact address counts. It also drafts Cisco-style standard, named, and extended ACL match examples, using host for /32 and any for /0. The examples describe address matching only; interface direction, protocol, ports, rule ordering, platform syntax, and security policy still require review.
Scenario Recipes
Translate a subnet plan into an ACL match
Goal: Avoid octet inversion mistakes while preserving the intended network boundary
- Enter an address from the target network and its CIDR prefix or subnet mask.
- Confirm the normalized network, broadcast, and wildcard values.
- Choose the closest ACL example, then add the required protocol, ports, sequence, and direction during device review.
Result: A reviewed address-match expression with an auditable subnet calculation.
Frequently Asked Questions
How is a wildcard mask calculated?
Each subnet-mask bit is inverted, equivalent to subtracting every octet from 255.
What do zero and one bits mean in a Cisco wildcard?
A zero bit must match the reference address; a one bit is ignored during the match.
Can I enter a dotted subnet mask?
Yes. Enter a contiguous mask such as 255.255.255.0 or a prefix such as /24.
Are non-contiguous masks supported?
No. This calculator converts normal CIDR subnet masks; arbitrary ACL wildcard patterns require separate rule design.
Why do /31 and /32 show usable addresses differently?
The tool treats /31 as a point-to-point pair and /32 as one host instead of subtracting network and broadcast.
Can I paste the generated ACL directly into production?
Review it first. Direction, protocol, ports, sequence, implicit deny behavior, and device syntax are outside this calculation.
Keep browsing