Wildcard Masks

Watch first

Plain-English explanation

A wildcard mask is the inverse of a subnet mask. Where the subnet mask has 1 (network bit), the wildcard has 0 — meaning "this bit must match." Where the wildcard has 1, that bit is don't care.

Example:

Subnet mask 255.255.255.0 → wildcard 0.0.0.255
Subnet mask 255.255.255.192 (/26) → wildcard 0.0.0.63

Think: wildcard 0 = care, wildcard 1 = ignore.

Deep dive

Matching logic: (address XOR wildcard) AND wildcard == 0 — simpler rule: compare only positions where wildcard octet bit is 0.

Common pairs:

| CIDR | Subnet mask | Wildcard | |------|-------------|----------| | /24 | 255.255.255.0 | 0.0.0.255 | | /16 | 255.255.0.0 | 0.0.255.255 | | /8 | 255.0.0.0 | 0.255.255.255 | | /32 (host) | 255.255.255.255 | 0.0.0.0 | | any | 0.0.0.0 | 255.255.255.255 |

OSPF example: network 10.1.0.0 0.0.255.255 area 0 matches all 10.1.x.x interfaces.

Step-by-step — build wildcard for 172.16.32.0/20

Mask: 255.255.240.0
Invert each octet: 256 − octet (or bitwise NOT in 8 bits)
- 255 → 0, 255 → 0, 240 → 15, 0 → 255
Wildcard: 0.0.15.255
ACL: access-list 10 permit 172.16.32.0 0.0.15.255

Verify: addresses 172.16.32.0 – 172.16.47.255 match.

Commands to know

Standard ACL with wildcard

access-list 10 permit 192.168.10.0 0.0.0.63 access-list 10 deny any ! interface GigabitEthernet0/0 ip access-group 10 in

OSPF network statement

router ospf 1 network 10.0.0.0 0.255.255.255 area 0

Troubleshooting

| Mistake | Effect | |---------|--------| | Used subnet mask in ACL | Matches wrong hosts — often too permissive or too strict | | Wildcard 0.0.0.0 on wrong network | Single-host match only | | Inverted wrong octet | OSPF doesn't activate on intended interfaces |

When an ACL "should work" but doesn't, log hits (if available) and verify wildcard math before reordering rules.

Exam relevance

Exam trap

A wildcard of 0.0.0.255 matches a /24 pattern but read the ACL network address too — 192.168.1.0 0.0.0.255 is not the same as 192.168.0.0 0.0.255.255.

Quick invert

For each mask octet: wildcard = 255 − mask octet (works for standard contiguous masks).

Practice checklist

Convert five subnet masks to wildcards without a calculator
Write an ACL matching exactly one /28 subnet
Write an OSPF network statement for 10.10.0.0/16
Explain the difference between any and 0.0.0.0 255.255.255.255
Spot the wrong wildcard in a list of four ACL lines

What wildcard mask matches 172.16.0.0/16?

What wildcard matches a single host 192.168.1.50?

Learning objectives