Wildcard Mask Calculator
Convert a subnet mask to its inverse wildcard mask.
From subnet mask to wildcard
Cisco access lists and OSPF do not use subnet masks — they use wildcard masks, the exact inverse. Getting the inversion wrong is a common source of ACL bugs, so this tool does it precisely.
A subnet mask of 255.255.255.0 inverts to a wildcard of 0.0.0.255. The tool validates that the mask is contiguous, then reports the wildcard, the prefix length, and the number of addresses covered.
Accurate and private
The inversion runs in your browser, so nothing you enter is uploaded.
Frequently Asked Questions
What is a wildcard mask?
The bit-by-bit inverse of a subnet mask, used in access control lists and OSPF where a 0 means match and a 1 means ignore.
How is it calculated?
Each octet is subtracted from 255, so 255.255.255.0 becomes 0.0.0.255.
Does it validate the mask?
Yes. It checks that the subnet mask is a valid contiguous mask before inverting it.
Browse the full set of free, private, in-browser tools.