Wildcard mask calculator
See which addresses a Cisco wildcard mask matches, test an IP against it, and turn CIDR blocks or ranges into access-list lines.
What does a wildcard match?
Example: type your own address and wildcard mask above.
- First match
- 192.0.2.0
- Last match
- 192.0.2.63
- Same as CIDR
- 192.0.2.0/26
The first 16 matches, and the last
- 192.0.2.0
- 192.0.2.1
- 192.0.2.2
- 192.0.2.3
- 192.0.2.4
- 192.0.2.5
- 192.0.2.6
- 192.0.2.7
- 192.0.2.8
- 192.0.2.9
- 192.0.2.10
- 192.0.2.11
- 192.0.2.12
- 192.0.2.13
- 192.0.2.14
- 192.0.2.15
- …
- 192.0.2.63
Write ACL lines
access-list 10 permit 192.0.2.0 0.0.0.255 access-list 10 permit 198.51.100.10 0.0.0.1 access-list 10 permit 198.51.100.12 0.0.0.3 access-list 10 permit 198.51.100.16 0.0.0.3 access-list 10 permit host 198.51.100.20 access-list 10 permit host 203.0.113.5
How it works
A wildcard mask tells a Cisco router which bits of an address to check. A 0-bit means "must match" and a 1-bit means "any value is fine". So 10.0.0.0 0.0.0.255 matches every address from 10.0.0.0 to 10.0.0.255, the same as the CIDR block 10.0.0.0/24.
Unlike a netmask, a wildcard's ones don't have to be together. 10.0.0.0 0.0.254.255 leaves the last bit of the third octet fixed at 0, so it matches only even subnets: 10.0.0.x, 10.0.2.x, 10.0.4.x and so on. Each 1-bit doubles the number of addresses that match.
Two shortcuts: host 192.0.2.1 means wildcard 0.0.0.0 (one address), and any means 255.255.255.255 (every address). If the address has bits set where the wildcard has ones, the router clears them, so 10.0.0.5 0.0.0.255 becomes 10.0.0.0 0.0.0.255.
An access list entry can only hold one address and wildcard, so a range like 198.51.100.10 to 198.51.100.20 needs several entries. This tool splits it into the fewest CIDR blocks, like the IP range to CIDR tool. To turn a netmask into a wildcard, use netmask to CIDR.