Wildcard masks: the inverted mask ACLs and OSPF insist on
In a wildcard mask, 0 means "must match" and 1 means "don't care". That is the opposite of a subnet mask, which is why 255.255.255.0 becomes 0.0.0.255. Convert by subtracting each octet from 255.
Almost everyone meets wildcard masks as an irritation — the thing that makes your access list match nothing at two in the morning. They are worth a few minutes of proper attention, because they can do something subnet masks structurally cannot, and that ability is the entire reason Cisco chose them.
Reading one
Line the wildcard up under the address and read bit by bit. Where the wildcard bit is 0, the address bit is checked. Where it is 1, the address bit is ignored entirely.
Converting without thinking
Two routes, depending on what you are given. From a subnet mask, subtract each octet from 255. From a prefix, the wildcard's interesting octet is block size minus one — a /27 has a block size of 32, so the wildcard is 0.0.0.31.
| Prefix | Subnet mask | Wildcard mask | Matches |
|---|---|---|---|
| /24 | 255.255.255.0 | 0.0.0.255 | One whole /24 |
| /25 | 255.255.255.128 | 0.0.0.127 | Half a /24 |
| /26 | 255.255.255.192 | 0.0.0.63 | A quarter |
| /27 | 255.255.255.224 | 0.0.0.31 | Departmental subnet |
| /30 | 255.255.255.252 | 0.0.0.3 | Point-to-point link |
| /32 | 255.255.255.255 | 0.0.0.0 | Exactly one host |
| /16 | 255.255.0.0 | 0.0.255.255 | A whole Class-B-sized range |
Note the two extremes. A wildcard of 0.0.0.0 checks every bit, so it matches exactly one host — IOS writes this as host. A wildcard of 255.255.255.255 checks nothing, matching everything — IOS writes that as any. The full table of prefix-to-mask-to-wildcard conversions is on the subnet mask cheat sheet.
The thing a subnet mask cannot do
A subnet mask must be contiguous: ones on the left, zeros on the right, no mixing. A wildcard has no such constraint, and that is where it earns its place.
Suppose you have VLANs on 10.1.0.0, 10.1.1.0, 10.1.2.0 … up to 10.1.15.0, and you need to permit only the odd-numbered ones. With subnet masks that is eight separate lines. With a wildcard it is one, because you can pin the low bit of the third octet to 1 and let the rest float:
R1(config)# access-list 10 permit 10.1.1.0 0.0.14.255
! third octet wildcard 14 = 00001110
! bit 0 = 0 → must match the 1 in 10.1.<1>.0 → odd subnets only
! bits 1-3 = 1 → ignored → covers 1, 3, 5, 7, 9, 11, 13, 15
! Result: eight odd subnets matched by a single line.This is genuinely useful and it is also, in fairness, rare. Most production ACLs use ordinary contiguous wildcards. But it explains why the format exists at all, and it is a favourite of exam writers.
Where IOS demands which
The rule of thumb: if the command configures an address, it wants a subnet mask. If it matches addresses, it wants a wildcard.
R1(config-if)# ip address 172.16.4.97 255.255.255.224 ← configures: subnet mask
R1(config)# access-list 10 permit 172.16.4.96 0.0.0.31 ← matches: wildcard
R1(config-router)# network 172.16.4.96 0.0.0.31 area 0 ← matches: wildcard
R1(config)# ip route 10.20.0.0 255.255.0.0 172.16.4.98 ← configures: subnet maskWhen an ACL mysteriously matches nothing, check this first. A subnet mask typed where a wildcard belongs is a valid command that quietly matches the wrong range — IOS will not warn you, and show ip access-lists showing zero matches on a line you expected to be busy is the symptom.
Frequently asked
What is a wildcard mask?
A wildcard mask tells a Cisco device which bits of an address must match and which it should ignore. A zero bit means the corresponding bit of the address must match exactly; a one bit means do not care. It is the logical inverse of a subnet mask, so 255.255.255.0 becomes 0.0.0.255. Cisco access control lists and OSPF network statements take wildcard masks, while interface addressing takes subnet masks.
How do I convert a subnet mask to a wildcard mask?
Subtract each octet from 255. A mask of 255.255.255.192 becomes 0.0.0.63, because 255 minus 255 is 0 for the first three octets and 255 minus 192 is 63 for the last. A quicker route from the prefix is that the wildcard's interesting octet is the block size minus one — a /26 has a block size of 64, so the wildcard is 0.0.0.63.
Why does Cisco use wildcard masks instead of subnet masks?
Because a wildcard can express matches a subnet mask cannot. A subnet mask must be contiguous — all the ones on the left, all the zeros on the right. A wildcard has no such rule, so its do-not-care bits can be scattered, letting one line match every odd-numbered subnet, or every fourth subnet, across a range. That flexibility is why access control lists and OSPF adopted the format, and it is the reason wildcards survive even though they confuse newcomers.
What does the host and any keyword mean in an ACL?
They are shorthand for two very common wildcards. The keyword host means a wildcard of 0.0.0.0, matching one exact address, so 'permit host 10.1.1.5' and 'permit 10.1.1.5 0.0.0.0' are identical. The keyword any means a wildcard of 255.255.255.255, ignoring every bit and therefore matching all addresses, so 'permit any' equals 'permit 0.0.0.0 255.255.255.255'. IOS will often rewrite your longhand into these keywords when it displays the configuration.
Does OSPF still need a wildcard mask in modern IOS?
The network statement under the OSPF process still takes one, and that is what CCNA 200-301 examines. However modern IOS also supports enabling OSPF directly on an interface with 'ip ospf process-id area area-id', which needs no wildcard at all and is often cleaner in production because it removes any ambiguity about which interfaces were matched. Both approaches are valid; you should be able to read and write either.
Wildcards turn up in the Security Fundamentals and IP Connectivity domains of CCNA. Related: CIDR notation, the subnet mask cheat sheet, the CCNA ACL lab and the CCNA OSPF lab.