Wildcard Mask Calculator

Convert between CIDR prefixes, dotted-decimal subnet masks and Cisco-style wildcard masks — in both directions.

Results for /2

192.0.0.0 is the /2 subnet mask; its wildcard mask is 63.255.255.255.

Input interpreted as: prefix length
Subnet mask: 192.0.0.0
Wildcard mask: 63.255.255.255
Prefix length: /2
Total addresses: 1,073,741,824
Usable hosts: 1,073,741,822
Network base: 192.0.0.0 (example network)
Broadcast address: 255.255.255.255 (example network)
Mask → wildcard: bitwise NOT of 192.0.0.0 = 63.255.255.255
Wildcard → mask: bitwise NOT of 63.255.255.255 = 192.0.0.0

Cisco ACL example

The wildcard tells the router which address bits matter: 0 bits must match exactly, 1 bits are ignored.

access-list 100 permit ip 192.0.0.0 63.255.255.255 any

Same prefix at a glance

Common prefix lengths: mask and wildcard pairs
Prefix	Subnet mask	Wildcard mask	Addresses
/16	255.255.0.0	0.0.255.255	65,536
/20	255.255.240.0	0.0.15.255	4,096
/22	255.255.252.0	0.0.3.255	1,024
/24	255.255.255.0	0.0.0.255	256
/25	255.255.255.128	0.0.0.127	128
/26	255.255.255.192	0.0.0.63	64
/27	255.255.255.224	0.0.0.31	32
/28	255.255.255.240	0.0.0.15	16
/29	255.255.255.248	0.0.0.7	8
/30	255.255.255.252	0.0.0.3	4
/31	255.255.255.254	0.0.0.1	2
/32	255.255.255.255	0.0.0.0	1

How wildcard masks work

A wildcard mask is the bitwise inverse of a subnet mask: every 1 in the mask becomes 0 in the wildcard and vice versa. Cisco IOS uses wildcards in extended and standard access lists (access-list), in OSPF network statements, and in route-map match clauses.

A wildcard 0.0.0.255 means “the first three octets must match, the last octet can be anything.”
A wildcard 0.0.0.0 matches exactly one address — equivalent to the host keyword.
A wildcard 255.255.255.255 matches every address, the same as the any keyword.
Converting back and forth never loses information: NOT(NOT(x)) = x.

To size the matching block instead, run the same input through the IPv4 subnet calculator, or grab the full mapping from the printable cheat sheet.