Wildcard Mask Calculator
Quick reference table
Common prefix lengths with their subnet and wildcard masks.
| Prefix | Subnet mask | Wildcard mask | Usable hosts |
|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,214 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,534 |
| /20 | 255.255.240.0 | 0.0.15.255 | 4,094 |
| /21 | 255.255.248.0 | 0.0.7.255 | 2,046 |
| /22 | 255.255.252.0 | 0.0.3.255 | 1,022 |
| /23 | 255.255.254.0 | 0.0.1.255 | 510 |
| /24 | 255.255.255.0 | 0.0.0.255 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 2 |
| /31 | 255.255.255.254 | 0.0.0.1 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 |
How it works
Enter a prefix length (/24), a full CIDR block (192.168.1.0/24), or a dotted-decimal subnet mask (255.255.255.0). The two input fields are linked — changing one automatically updates the other.
A wildcard mask is the bitwise complement of a subnet mask. Each octet of the wildcard mask equals 255 − (subnet mask octet). For /24 the subnet mask is 255.255.255.0, so the wildcard is 0.0.0.255.
In a wildcard mask, a 0 bit means “this bit must match” and a 1 bit means “don't care.” This is the opposite of a subnet mask, where 1 marks the fixed network bits.
Wildcard masks appear in Cisco IOS ACLs and OSPF network statements:
Most modern firewalls and Juniper JunOS use standard subnet masks instead of wildcard masks. EIGRP network statements also accept wildcard masks. Non-contiguous wildcard masks (e.g. 0.0.0.254 to match only even addresses) are supported by some platforms but are uncommon and are not generated by this calculator.
FAQ
What is a wildcard mask?
A wildcard mask is the inverse (bitwise NOT) of a subnet mask. Where a subnet mask uses 1s to indicate network bits, a wildcard mask uses 1s to indicate "don't care" bits. For example, the wildcard mask for /24 (255.255.255.0) is 0.0.0.255.
Where are wildcard masks used?
Wildcard masks are primarily used in Cisco IOS access control lists (ACLs) and OSPF network statements. They define which bits of an IP address must match (0) and which are ignored (1). Some platforms like Juniper use standard subnet masks instead.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet of the subnet mask from 255. For example, 255.255.255.0 becomes 0.0.0.255 (255−255=0, 255−255=0, 255−255=0, 255−0=255). Alternatively, perform a bitwise NOT on the subnet mask.
What is the wildcard mask for a /24 network?
The wildcard mask for /24 is 0.0.0.255. The subnet mask is 255.255.255.0, and inverting it gives 0.0.0.255. This means the first 24 bits must match and the last 8 bits are ignored.