Wildcard Mask Cheat Sheet
The wildcard mask — also called the inverse mask — for every IPv4 prefix from /0 to /32, alongside the subnet mask it inverts. Cisco access lists, OSPF and EIGRP all expect this form rather than the subnet mask.
| Wildcard Mask | CIDR | Subnet Mask | Addresses Matched | Host Bits |
|---|---|---|---|---|
| 0.0.0.0 | /32 | 255.255.255.255 | 1 | 0 |
| 0.0.0.1 | /31 | 255.255.255.254 | 2 | 1 |
| 0.0.0.3 | /30 | 255.255.255.252 | 4 | 2 |
| 0.0.0.7 | /29 | 255.255.255.248 | 8 | 3 |
| 0.0.0.15 | /28 | 255.255.255.240 | 16 | 4 |
| 0.0.0.31 | /27 | 255.255.255.224 | 32 | 5 |
| 0.0.0.63 | /26 | 255.255.255.192 | 64 | 6 |
| 0.0.0.127 | /25 | 255.255.255.128 | 128 | 7 |
| 0.0.0.255 | /24 | 255.255.255.0 | 256 | 8 |
| 0.0.1.255 | /23 | 255.255.254.0 | 512 | 9 |
| 0.0.3.255 | /22 | 255.255.252.0 | 1,024 | 10 |
| 0.0.7.255 | /21 | 255.255.248.0 | 2,048 | 11 |
| 0.0.15.255 | /20 | 255.255.240.0 | 4,096 | 12 |
| 0.0.31.255 | /19 | 255.255.224.0 | 8,192 | 13 |
| 0.0.63.255 | /18 | 255.255.192.0 | 16,384 | 14 |
| 0.0.127.255 | /17 | 255.255.128.0 | 32,768 | 15 |
| 0.0.255.255 | /16 | 255.255.0.0 | 65,536 | 16 |
| 0.1.255.255 | /15 | 255.254.0.0 | 131,072 | 17 |
| 0.3.255.255 | /14 | 255.252.0.0 | 262,144 | 18 |
| 0.7.255.255 | /13 | 255.248.0.0 | 524,288 | 19 |
| 0.15.255.255 | /12 | 255.240.0.0 | 1,048,576 | 20 |
| 0.31.255.255 | /11 | 255.224.0.0 | 2,097,152 | 21 |
| 0.63.255.255 | /10 | 255.192.0.0 | 4,194,304 | 22 |
| 0.127.255.255 | /9 | 255.128.0.0 | 8,388,608 | 23 |
| 0.255.255.255 | /8 | 255.0.0.0 | 16,777,216 | 24 |
| 1.255.255.255 | /7 | 254.0.0.0 | 33,554,432 | 25 |
| 3.255.255.255 | /6 | 252.0.0.0 | 67,108,864 | 26 |
| 7.255.255.255 | /5 | 248.0.0.0 | 134,217,728 | 27 |
| 15.255.255.255 | /4 | 240.0.0.0 | 268,435,456 | 28 |
| 31.255.255.255 | /3 | 224.0.0.0 | 536,870,912 | 29 |
| 63.255.255.255 | /2 | 192.0.0.0 | 1,073,741,824 | 30 |
| 127.255.255.255 | /1 | 128.0.0.0 | 2,147,483,648 | 31 |
| 255.255.255.255 | /0 | 0.0.0.0 | 4,294,967,296 | 32 |
A 0 bit in a wildcard mask must match; a 1 bit is ignored. Addresses matched counts every address in the block, including the network and broadcast addresses.
Reading a Wildcard Mask
A subnet mask and a wildcard mask carry the same boundary in opposite polarity. For a /26 network the subnet mask is 255.255.255.192 — the first 26 bits are 1 and must match. The wildcard mask is 0.0.0.63: the same 26 bits are 0, and the final six are 1, free to take any value.
The arithmetic is a per-octet subtraction from 255, so the two masks in each row of the table above always sum to 255.255.255.255.
Common Wildcard Masks
- 0.0.0.0 — /32. Matches one address exactly. Cisco ACLs accept the keyword host as shorthand.
- 0.0.0.255 — /24. Matches a whole /24 — the last octet is free to vary.
- 0.0.0.63 — /26. Matches a /26, the usual size for a small VLAN.
- 0.0.255.255 — /16. Matches a /16, common in OSPF area statements.
- 255.255.255.255 — /0. Matches every address. Written as the keyword any in an ACL.
Frequently Asked Questions
What is a wildcard mask?
A wildcard mask is the bitwise inverse of a subnet mask: every 1 becomes a 0 and every 0 becomes a 1. Where a subnet mask marks which bits must match to be in the network, a wildcard mask marks which bits are free to vary. A 0 in a wildcard mask means the corresponding address bit must match exactly; a 1 means it is ignored.
How do you convert a subnet mask to a wildcard mask?
Subtract each octet of the subnet mask from 255. A /24 subnet mask of 255.255.255.0 becomes the wildcard mask 0.0.0.255, and a /26 mask of 255.255.255.192 becomes 0.0.0.63. The table above lists the result for all 33 prefix lengths.
Where are wildcard masks used?
Cisco IOS access control lists, OSPF network statements and EIGRP network statements all take a wildcard mask rather than a subnet mask. For example, 'network 10.1.0.0 0.0.255.255 area 0' matches the whole of 10.1.0.0/16 because the wildcard leaves the final two octets free to vary.
Is a wildcard mask the same as an inverse mask?
Yes. 'Inverse mask' and 'wildcard mask' describe the same value, and Cisco documentation uses both. Unlike a subnet mask, a wildcard mask does not have to be contiguous — a discontiguous wildcard can match, for instance, only odd-numbered subnets — though contiguous wildcards mirroring a real subnet mask are what almost all configurations use.