Wildcard Mask Calculator

The bitwise inverse of a subnet mask, used by Cisco IOS to say which address bits matter. A 0 means the bit must match exactly; a 1 means ignore it. It is the opposite convention to a subnet mask, which is why they are so easy to mix up.

Subtract each octet from 255. 255.255.255.0 becomes 0.0.0.255; 255.255.240.0 becomes 0.0.15.255. That is all there is to it.

Cisco IOS access control lists, OSPF and EIGRP network statements, and route maps. Interface addressing still takes a normal subnet mask, which is the source of most of the confusion.

Match this exact address and nothing else - the equivalent of a /32. In an ACL you can write it as the keyword host instead, and most style guides prefer that for readability.

Ignore every bit, so match any address at all. IOS lets you write this as the keyword any.

Yes, and that is the one real capability a subnet mask lacks. A wildcard of 0.0.0.254 matches only even-numbered hosts. It is legal, occasionally useful, and worth a comment in the config because the next engineer will assume it is a typo.

They came from the original ACL implementation, where inverting the mask made the bit test cheaper in hardware. The convention outlived the reason, and newer platforms such as NX-OS and ASA accept prefix lengths directly.

Yes - inverse mask, wildcard mask and, in older Cisco documentation, don't-care bits all describe the same thing.