Necessary cookies and storage support sign-in and learning. Optional Vercel analytics and campaign measurement stay off unless you accept. Rejecting won't affect courses or checkout.
Global Privacy Control is on. Optional analytics stays off.
FREE TOOL
Convert between a subnet mask and an access control list (ACL) wildcard mask, or test whether an address matches an ACL address and wildcard pair. Wildcards that do not describe a single prefix, such as 0.0.255.0, are accepted for matching. The calculation runs in this page, and the page does not send what you type to a server. No account is required.
This calculator runs in your browser and needs JavaScript turned on. The boxes stay locked until the page script loads, so the page cannot send anything you enter. If they stay locked, the script did not load. Turn on JavaScript or reload the page to use the calculator.
The calculator is ready. It runs in this page, and the page does not send what you enter to a server.
Each step shows the 32 bits in binary and dotted decimal. Network bits are shown in bold and host bits in normal weight where a prefix applies.
A wildcard mask is 32 bits that tell an ACL entry which address bits to compare. A 0 bit means the address bit must equal the same bit in the ACL address. A 1 bit means that bit is ignored. So 10.1.1.0 0.0.0.255 matches every address that starts with 10.1.1, because the last 8 bits are ignored.
The calculator tests a match the same way, one bit at a time. It inverts the wildcard to mark the bits that must match, XORs the two addresses to find the bits that differ, and ANDs those two results. If no differing bit falls on a must-match bit, the address matches.
To practice, decide which bits of 10.1.77.5 the wildcard 0.0.255.0 ignores before you test it against 10.1.0.5. Then check your answer against step 1 and the outcome against step 3.
For a subnet mask, the wildcard is the bitwise inverse of the mask. Per octet that is 255 minus the mask octet, so 255.255.255.192 becomes 0.0.0.63. Converting back works the same way, as long as the inverse is a valid subnet mask, which means a run of ones followed by zeros.
A subnet mask must be contiguous, but a wildcard does not have to be. The wildcard 0.0.255.0 ignores the third octet, so 10.1.0.5 0.0.255.0 matches 10.1.0.5, 10.1.1.5, and every other 10.1.x.5 address. Those 256 addresses are not one block, so no single prefix describes them. When you convert such a wildcard, the calculator reports that it is not representable as a single prefix, and the match form still accepts it. In the same way, 192.168.1.1 0.0.0.254 matches the 128 odd addresses in 192.168.1.0/24, from 192.168.1.1 to 192.168.1.255. The last of those is the subnet's broadcast address, not a host.
The calculator compares one address with one ACL address and wildcard pair. It does not read a full access list, so it does not apply rule order, the implicit deny at the end of a list, or protocol and port matching. A match here means the address bits match that one entry, not that a packet is permitted.
Commands other than ACL entries also take wildcard masks, and this calculator does not check what a particular command or platform accepts.
Source for wildcard bit behavior: Cisco IOS security configuration guide, IP access list overview.