Convert between subnet masks and wildcard masks for Cisco ACLs.
-
-
-
access-list or network statement.A wildcard mask flips the logic of a subnet mask. While a subnet mask marks network bits with 1s, a wildcard uses 0s to flag the bits that have to match exactly.
Wildcard masks let an ACL match non-contiguous bit patterns—the kind of irregular shapes subnet masks just can't handle. In practice, though, most ACLs stick to contiguous wildcards that map directly to CIDR prefixes.
Yes. A wildcard like 0.0.255.255 matches any second-half octet, but 0.0.0.85 matches only odd third-octet values — useful for advanced filtering tricks.
0.0.0.0 — every bit must match exactly. Cisco IOS also accepts the keyword host as a shorthand.