Wildcard Mask Calculator
See exactly which IPv4 bits an access-list wildcard checks and which it ignores. Normalize the rule address, test a candidate address, count the matching combinations, and receive a CIDR equivalent only when the inverse mask is truly contiguous.
Enter an ACL address pattern
The first 24 bits must match 192.168.10. The final eight bits are ignored, so 256 IPv4 bit patterns match. This contiguous wildcard is the inverse of 255.255.255.0 and can be described as 192.168.10.0/24.
How wildcard matching works
An IPv4 wildcard is a 32-bit comparison stencil used in access-control and related network configuration. A wildcard bit of zero tells the device to compare the corresponding address bit. A wildcard bit of one tells the device that the corresponding bit does not matter for this rule. That meaning is the reverse of the familiar subnet-mask bit convention.
Normalized rule = rule address AND (NOT wildcard)
Matching combinations = 2number of wildcard 1 bits
Inverse mask = 255.255.255.255 minus wildcard, octet by octet
XOR identifies bits that differ. NOT wildcard changes checked positions to ones and ignored positions to zeros. AND then removes differences in ignored positions. A zero result means every checked bit matches. This is the test the result panel expresses in dotted decimal and binary.
Changing a rule-address bit located under a wildcard one does not change the matched set. Normalization clears every ignored rule bit to zero, producing a stable representation for documentation and comparison.
Contiguous wildcards and CIDR
A conventional subnet wildcard is the bitwise inverse of a contiguous subnet mask. Its binary form begins with checked zeros and ends with ignored ones. Examples include 0.0.0.0 for one exact address, 0.0.0.255 for a /24-sized bit set, and 0.0.3.255 for a /22-sized set.
When the inverse is contiguous, the count of zero wildcard bits equals the CIDR prefix length. The normalized low pattern and high envelope form one continuous numeric interval. The calculator then displays a CIDR label as a convenient equivalent description of the matched address set.
CIDR describes an address prefix; an ACL describes which packet addresses match a rule. Even when their set of addresses is identical, their operational purposes differ. The ACL can permit, deny, classify, route, or otherwise act on matches according to platform and feature.
Noncontiguous wildcards are not subnets
A wildcard may alternate checked and ignored bits, such as 0.0.5.255. That produces multiple separated groups of addresses rather than one subnet prefix. Subtracting from all ones still yields an inverse bit mask, but the result is not a valid contiguous subnet mask and has no single CIDR prefix.
For an arbitrary wildcard, the displayed low pattern and high bit envelope bound the numeric possibilities but do not claim every address between them matches. The actual set contains only combinations formed by changing ignored bits while all checked bits remain equal.
Noncontiguous masks can be concise but hard to review. Confirm platform support, generate test cases for each intended and unintended region, and prefer multiple clear entries when maintainability or auditability matters more than line count.
Worked 192.168.10.0 wildcard example
Enter rule address 192.168.10.0 and wildcard 0.0.0.255. The first three wildcard octets contain 24 zero bits, so all 24 corresponding address bits must match. The last octet contains eight one bits, so every last-octet pattern is ignored by the comparison.
The normalized address remains 192.168.10.0. There are 2 to the eighth power, or 256, matching IPv4 bit patterns: numeric values from 192.168.10.0 through 192.168.10.255. Test address 192.168.10.42 shares all checked bits and therefore matches.
The inverse mask is 255.255.255.0, which is contiguous. The set can be labeled 192.168.10.0/24. An ACL match includes the endpoint bit patterns .0 and .255; the calculator does not subtract traditional network and broadcast addresses because it is evaluating an address filter, not assigning usable hosts to an interface subnet.
Common wildcard patterns
| Wildcard | Bit meaning | Typical interpretation |
|---|---|---|
| 0.0.0.0 | All 32 bits checked | One exact IPv4 address; often represented by a host keyword on supported platforms. |
| 0.0.0.255 | 24 checked, 8 ignored | One contiguous /24-sized address set when paired with a normalized rule address. |
| 0.0.3.255 | 22 checked, 10 ignored | One contiguous /22-sized address set. |
| 0.0.255.255 | 16 checked, 16 ignored | One contiguous /16-sized address set. |
| 255.255.255.255 | No bits checked | Every IPv4 address; commonly represented by any in ACL syntax. |
| 0.0.5.255 | Mixed fixed and ignored bits | A discontiguous pattern set, not one subnet and not one CIDR prefix. |
An ACL wildcard does not count usable hosts
A subnet sizing tool may subtract a network address and broadcast address under traditional IPv4 host-allocation rules. A wildcard filter does not perform that subtraction. It compares all 32 bits of the packet address using the mask, so any endpoint pattern that satisfies the checked bits matches—including addresses that might serve special roles in a particular subnet context.
Matching also does not prove a packet will pass. ACL order, action, protocol, source and destination direction, ports, established-state logic, interface application, route path, implicit rules, object groups, platform syntax, and other policy layers determine the final outcome. Review the complete configuration and test in a safe environment.
Rule-review checklist
- Normalize the rule address so ignored bits are cleared and duplicate intent is easier to spot.
- Verify whether the target platform uses wildcard masks, standard netmasks, prefix notation, or a different object syntax.
- Confirm every zero bit is intentionally fixed and every one bit is intentionally ignored.
- For noncontiguous masks, enumerate representative matches and near-misses rather than trusting the numeric envelope.
- Review entry order and the platform’s implicit final behavior.
- Test source and destination direction, protocol, ports, and interface placement with counters or an approved lab method.
- Document the business purpose, owner, expiration or review date, and rollback plan.
Do not paste an illustrative rule into production merely because its address math is correct. Network access changes can interrupt service or expose systems. Use change control, peer review, backups, out-of-band recovery, and the exact current documentation for the device software.
Audit an arbitrary wildcard without guessing
Start by writing the rule address, wildcard, and intended business set in separate columns. Normalize the rule address with this calculator, then compare the normalized version with the deployed configuration. Different text can describe the same match set when differences occur only under ignored bits. Normalization exposes those duplicates and makes later peer review less dependent on mental binary conversion.
Next, divide candidate addresses into equivalence classes based on checked bits. A passing example must agree at every wildcard-zero position; a failing example needs only one checked-bit difference. For a noncontiguous wildcard, choose tests around every ignored-bit island and every fixed-bit boundary. Include low and high octet values, not just the visually obvious middle of a range. The numeric low and high envelope is useful for bounding tests, but addresses inside the envelope still fail whenever one interleaved checked bit differs.
Count comparison combinations separately from traffic expectations. A rule matching 65,536 source addresses does not imply that those addresses are routed, assigned, reachable, trustworthy, or present on the interface. Likewise, private-use address status does not grant access. Filtering policy must be based on verified network ownership, topology, threat model, and least privilege rather than address arithmetic alone.
Finally, compare the intended match set with actual counters or a platform-supported simulation in a controlled environment. Confirm that return traffic, asymmetric routing, network address translation, tunnels, IPv4 fragments, and stateful inspection do not change which header the device evaluates. Save the normalized rule, representative pass/fail cases, software version, and test evidence with the change record. That evidence is far easier to review later than an unexplained wildcard copied from a command line.
Wildcard mask FAQs
What does zero mean in a wildcard mask?
Zero means the corresponding address bit must be checked and must match the rule address. One means that bit is ignored for this comparison.
Is every wildcard the inverse of a subnet mask?
Every 32-bit wildcard can be inverted, but only an inverse with contiguous one bits followed by zero bits is a conventional subnet mask. Noncontiguous wildcards have no single CIDR equivalent.
Why does 0.0.0.255 match 256 addresses?
Its eight one bits can take any combination, producing 2⁸ or 256 bit patterns. ACL matching does not remove network or broadcast endpoint patterns.
What wildcard matches one host?
0.0.0.0 checks every bit, so only the exact rule address matches. Some device syntaxes provide a host keyword that implies the same wildcard.
What wildcard matches any IPv4 address?
255.255.255.255 ignores all 32 bits, so the rule-address value becomes irrelevant. Platforms often provide an any keyword for this intent.
Can I use this result as a complete ACL?
No. It solves the IPv4 address-pattern portion. The device still requires correct action, protocol, source/destination placement, ports, direction, ordering, platform syntax, and deployment controls.
References
These primary networking sources support the bit-check semantics and IPv4 context used by the calculator.