Kernaali Tools
Home / Network tools / Wildcard Mask Calculator
Address planning

Wildcard Mask Calculator

Convert between a contiguous subnet mask and its inverse ACL wildcard.

Local calculation · inputs are not sent to a server.

Result

Calculating the example…

How it works

Invert every mask bit. In decimal octets this is 255 minus each octet. A zero wildcard bit means match that address bit; a one permits either value.

Worked example

255.255.255.192 becomes 0.0.0.63. With an aligned network of 10.42.7.64, this wildcard covers the same address set as /26.

Inputs, edge cases & common mistakes

This tool supports contiguous CIDR-derived wildcards. Some ACL implementations accept noncontiguous wildcards; those cannot be represented by one CIDR and are rejected here. Confirm the vendor command uses wildcard semantics.

Technical references

Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.