Course contents

Chapter 12: Security FundamentalsLesson 13 of 18

Wildcard masks

The inverse of a subnet mask: 0 matches, 1 ignores; host and any, calculations and use in ACLs and OSPF.

Intermediate · 9 min read

Technical definition

Wildcard mask is a 32-bit pattern that tells a Cisco router which bits of an address must match. A 0 bit means the bit must match exactly; a 1 bit means ignore it. It is used by ACLs and by OSPF network statements.

0 matches, 1 ignores

Write the address and the wildcard in binary. Wherever the wildcard has a 0, the address bit must equal the pattern. Wherever it has a 1, anything goes.

Subnet mask to wildcard mask
Subnet mask to wildcard maskPrefix; Subnet mask; Wildcard mask; How to get it. /8: 255.0.0.0 0.255.255.255 255 minus each octet /16: 255.255.0.0 0.0.255.255 255 minus each octet /24: 255.255.255.0 0.0.0.255 255 minus each octet /27: 255.255.255.224 0.0.0.31 255 − 224 = 31 /30: 255.255.255.252 0.0.0.3 255 − 252 = 3 /32: 255.255.255.255 0.0.0.0 A single host /0: 0.0.0.0 255.255.255.255 Any addressPrefixSubnet maskWildcard maskHow to get it/8255.0.0.00.255.255.255255 minus each octet/16255.255.0.00.0.255.255255 minus each octet/24255.255.255.00.0.0.255255 minus each octet/27255.255.255.2240.0.0.31255 − 224 = 31/30255.255.255.2520.0.0.3255 − 252 = 3/32255.255.255.2550.0.0.0A single host/00.0.0.0255.255.255.255Any address

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each octet of the wildcard is 255 minus the subnet mask octet. The wildcard always has the block size minus 1 in the interesting octet.

Worked examples

  • 192.168.10.0 0.0.0.255 matches 192.168.10.0 to 192.168.10.255: the first three octets must match, the last can be anything.
  • 172.16.32.0 0.0.15.255 matches 172.16.32.0 to 172.16.47.255. Third octet: 15 ignores the last four bits, so 32 to 47.
  • 10.1.1.1 0.0.0.0 matches one address only.
  • 10.1.0.0 0.0.254.255 is non-contiguous: it ignores every bit of the third octet except the last, which must be 0, so it matches only even third octets.

Where you use it

! ACL: permit hosts in 192.168.10.0/24 access-list 10 permit 192.168.10.0 0.0.0.255 ! Single host and any access-list 10 permit host 192.0.2.5 access-list 10 deny any ! OSPF: enable on interfaces in 10.1.1.0/24 router ospf 1 network 10.1.1.0 0.0.0.255 area 0

ACLs and OSPF use the same wildcard syntax. The ACL examples are illustrations of syntax, not a complete policy.

Reading a block size

For /27 subnet 192.168.1.64: block size 32, wildcard 0.0.0.31. The range is 192.168.1.64 to 192.168.1.95. Check with the wildcard calculator.

Test yourself

Predict · scenario 1

What is the wildcard mask for the subnet mask 255.255.255.240?

Predict · scenario 2

What does 172.16.32.0 0.0.15.255 match?

Predict · scenario 3

Which wildcard matches exactly one host?

FAQ

Is a wildcard mask just the inverse of the subnet mask?
For a contiguous network, yes: subtract each octet of the subnet mask from 255. But a wildcard mask can also be non-contiguous, which a subnet mask cannot, so it is a separate concept.
What do host and any mean?
host 192.0.2.5 is the same as 192.0.2.5 0.0.0.0 (match every bit). any is the same as 0.0.0.0 255.255.255.255 (ignore every bit).
Why do OSPF network statements use wildcard masks?
Cisco chose the same pattern-matching syntax as ACLs. network 10.1.1.0 0.0.0.255 area 0 turns OSPF on for every interface whose address matches 10.1.1.x.