Wildcard Mask Calculator
Convert between CIDR prefix, subnet mask and wildcard mask (inverse mask) for ACLs and OSPF. Shows all three forms plus host count.
Last reviewed by the Radiatus Cloud team
Convert a CIDR prefix or subnet mask into the wildcard (inverse) mask used in ACLs and OSPF.
Need this monitored 24/7?
Radiatus delivers managed cloud & network operations.
Convert subnet masks to wildcard masks
A wildcard mask, also called an inverse mask, is the bitwise opposite of a subnet mask. Where a subnet mask uses ones to mark the network portion of an address, a wildcard mask uses zeros, so a subnet mask of 255.255.255.0 becomes a wildcard mask of 0.0.0.255. This calculator converts freely between the CIDR prefix, the subnet mask and the wildcard mask, and shows how many addresses the block contains.
You can start from a prefix length such as /24, or from a dotted subnet mask, and the tool validates that the mask is a proper contiguous mask before converting.
Where wildcard masks are used
Wildcard masks are required by several networking technologies, most notably Cisco access control lists and the OSPF routing protocol, both of which match address ranges using the inverse of a subnet mask. Network engineers frequently need to translate a familiar subnet mask into its wildcard form when writing firewall rules or routing configuration.
Because a one in a wildcard mask means "match any value in this bit", wildcard masks can also express non-contiguous patterns, though this calculator focuses on the standard contiguous masks that correspond to subnets. All calculation happens locally in your browser.
Related tools
- Port Scanner — Check which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
- DNS Misconfiguration — Analyze DNS records (TXT, SPF) for security gaps.
- TLS Compat Tester — Check client-server compatibility for TLS versions.
- Firewall Rule Risk — Evaluate firewall rules for over-permissive exposure.
Frequently Asked Questions
What is a wildcard mask?
It is the bitwise inverse of a subnet mask. Zeros mark bits that must match and ones mark bits that can be anything, which is how ACLs and OSPF select ranges.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet from 255. A subnet mask of 255.255.255.0 gives a wildcard mask of 0.0.0.255, which the tool computes for you.
Where are wildcard masks used?
Mainly in Cisco access control lists and the OSPF routing protocol, which match address ranges using the inverse of a subnet mask.
Why does it reject some masks?
A valid subnet mask has all its ones together at the front. The tool checks this and rejects non-contiguous masks that do not correspond to a real subnet.
What does the host-bit count mean?
It is the number of zero bits in the subnet mask, which determines how many addresses the block contains, equal to two raised to that power.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Enter a CIDR prefix (0-32) or a subnet mask to get the wildcard mask.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Port Scanner
NetworkCheck which common ports respond on a host and understand what each exposed service means. Scan only systems you are authorised to test.
DNS Misconfiguration
NetworkAnalyze DNS records (TXT, SPF) for security gaps.
TLS Compat Tester
NetworkCheck client-server compatibility for TLS versions.