How to use the wildcard mask calculator for acls
- Enter an IPv4 address and choose whether the mask you will type is a wildcard mask, a subnet mask or a prefix length.
- Type the mask. Wildcard bits set to 1 are ignored by the rule; a subnet mask must be ones followed by zeros.
- Optionally list addresses to test, one per line, to see which of them the rule matches.
- Read the wildcard, the rule address, the number of addresses matched and the lowest and highest address.
Formula
wildcard = NOT subnet mask
rule address = address AND NOT wildcard
matched addresses = 2^(number of 1 bits in the wildcard)
an address matches when (address XOR rule address) AND NOT wildcard = 0
A wildcard of all ones in the last octet, 0.0.0.255, is the mirror of the subnet mask 255.255.255.0. Wildcards need not be one block: 0.0.0.254 ignores every bit of the last octet except the last.
A /24 and a pattern of even addresses
The address 192.168.10.0 with wildcard 0.0.0.255 matches 2^8 = 256 addresses, from 192.168.10.0 to 192.168.10.255. The subnet mask is 255.255.255.0 and the prefix is /24. The test address 192.168.10.77 matches and 192.168.11.5 does not.
The address 10.1.2.0 with wildcard 0.0.0.254 matches 2^7 = 128 addresses, namely the even ones in 10.1.2.0 to 10.1.2.254. Then 10.1.2.4 matches, while 10.1.2.5 and 10.1.3.4 do not. This is not one subnet, so the page says so and lists the first eight matching addresses.
Why access lists use wildcards
Some network devices write rules as an address and a wildcard mask instead of a subnet mask, because a wildcard can describe patterns a subnet cannot. Remember that the wildcard is the opposite way round from a subnet mask: 0 means the bit must match and 1 means anything goes.
For ordinary blocks, the Subnet Calculator also shows the wildcard. This page adds scattered patterns and a test list, which helps when you want to check a rule before you apply it. The CIDR Aggregator merges blocks into the smallest list.
Checking a rule
Enter a few addresses that should match and a few that should not, and read the result column. Edge addresses, such as the first and last of the range and one just outside, are the best tests.
Assumptions and limits
- Only IPv4 addresses in dotted decimal form are read; each part must be 0 to 255.
- If the address you enter has bits set where the wildcard ignores them, the rule address is the same with those bits cleared, and the page tells you.
- The list of sample matches shows the first eight in numeric order.
- Up to 200 test addresses can be checked at once.
- The page checks the arithmetic of a rule; the exact syntax and order of rules on a device is your responsibility.
Frequently asked questions
How is a wildcard mask different from a subnet mask?
It is the bitwise opposite. In a subnet mask 1 means the bit is part of the network; in a wildcard 1 means the bit is ignored.
Why does the page say Not one block?
A subnet is a run of addresses sharing a prefix. A wildcard such as 0.0.0.254 ignores some bits but not the last one, so it matches addresses scattered through the range.
What is the wildcard for a single host?
0.0.0.0, which matches only that address. The page then shows a count of 1.
Does the tool understand IPv6?
No. For IPv6 prefixes use the IPv6 subnet planner.