ACL Wildcard Mask Calculator

0 match 1 ignore

Networks and ACL patterns:

Up to 128 nonblank lines. Processing stays in this browser.

CIDR, subnet-mask, wildcard-mask, host, and any forms may be mixed.

Mask interpretation:

Auto treats familiar contiguous high-bit masks as subnet masks and keeps other dotted values as wildcards; the resolved mode appears in the math table.

ACL action:

Choose the action for the generated IOS-style address entries.

ACL line prefix:

For example, access-list 10; leave blank for action-only lines.

Network input needs attention

{{ issue.message }}

ACE target style:

This changes generated syntax only; the canonical address match stays the same.

Input	Resolved as	ACL target	Addresses	Generated ACE	Copy
{{ row.input }}	{{ row.parse_mode }}	{{ row.target }}	{{ formatInteger(row.match_count) }}	{{ row.ace }}

Match form	Subnet / care mask	Wildcard	Binary wildcard	Fixed / ignored	Copy
{{ row.match_form }}	{{ row.care_mask }}	{{ row.wildcard }}	{{ row.binary_wildcard }}	{{ row.fixed_bits }} / {{ row.ignored_bits }}

Severity	Scope	Finding	Next check	Copy
{{ row.severity }}	{{ row.scope }}	{{ row.finding }}	{{ row.recommendation }}

Matched IPv4 addresses · logarithmic scale

An IPv4 access control entry can describe one host, a contiguous network, a scattered bit pattern, or every address. The wildcard mask controls that address test. A zero bit means the corresponding address bit must match; a one bit means the packet bit may vary.

This is the inverse of ordinary subnet-mask notation. The subnet mask 255.255.255.0 fixes its first 24 bits, while the corresponding ACL wildcard 0.0.0.255 ignores the last 8. Both describe the same contiguous /24 address block when paired with the same network address.

Care bit: A wildcard zero; the configured and tested address bits must be equal.
Ignored bit: A wildcard one; either value may appear in the tested address.
Non-contiguous wildcard: A pattern with ignored bits separated by care bits, so it cannot be represented as one CIDR block.

Wildcard notation deserves more than a decimal glance. The pattern 0.0.0.0 fixes all 32 bits and matches one host. At the other extreme, 255.255.255.255 ignores every bit and matches the entire IPv4 space. Between those cases, each additional ignored bit doubles the possible address combinations.

Non-contiguous masks are valid in Cisco-style ACL address tests. For example, 0.0.254.255 ignores selected bits across the third octet as well as the entire fourth octet. It describes a bit pattern rather than one ordinary subnet, which makes peer review and change records especially important.

The address pattern is only one part of traffic policy. Permit or deny action, entry order, protocol and port fields, source or destination position, interface direction, existing object groups, and platform behavior can all change the deployed outcome. A mathematically correct wildcard is not proof that an ACL is safe.

How to Use This Tool:

Normalize mixed IPv4 notes first, then examine breadth and ordering concerns before using the generated address entries.

Paste one CIDR, address-and-mask pair, host entry, or any entry per line in Networks and ACL patterns. Comment lines beginning with # are ignored.
Choose Mask interpretation. Auto detect handles familiar high-bit contiguous subnet masks and otherwise treats dotted values as wildcards; pin a mode when every dotted value has one known meaning.
Set the ACL action, optional line prefix, and target style. These choices change generated syntax but not the underlying address match.
Correct any Network input needs attention message, then compare the generated target, fixed and ignored bits, match count, and audit findings. Lists are limited to 128 nonblank patterns.

Interpreting Results:

Ready means no entered pattern triggered the built-in broadness, overlap, duplicate, normalization, or non-contiguous checks. Review means at least one review-level concern exists. Broad appears when a pattern is any or a contiguous /0 to /8.

Read the audit as a prompt for configuration review, not a verdict. A /16 is marked for review and a /8 or shorter prefix receives stronger attention, but either scope may be intentional. Check the generated entry in the complete ACL and confirm that a broader earlier rule does not hide a narrower exception.

Technical Details:

IPv4 addresses and masks are treated as 32-bit values. Contiguous CIDR input first becomes a care mask, then the wildcard is its bitwise inverse. Host bits in a contiguous input address are removed to produce the network target.

Formula Core

For a contiguous subnet mask S, the 32-bit wildcard W is the complement of the subnet mask.

W = 2^{32} - 1 - S

If i wildcard bits are one, the address pattern has 2 raised to i possible matches. This counts bit combinations, not usable subnet hosts.

N = 2^{i}

A tested address X matches configured address A when every care bit agrees. With care mask C equal to the inverse of W, the bit test is:

(X \oplus A) \land C = 0

Rule Core

Wildcard parsing and review rules
Condition	Result
CIDR suffix /0 to /32	Convert the prefix to a contiguous care mask and inverse wildcard.
Forced subnet mode	Require a contiguous dotted subnet mask; reject a non-contiguous value.
Auto mode with a familiar contiguous high-bit mask	Read the dotted value as a subnet mask.
Other dotted values in Auto mode	Read the dotted value as an ACL wildcard, including non-contiguous patterns.
Contiguous prefix /0 to /8	Flag broad scope; `any` receives Critical severity.
Contiguous prefix /9 to /16	Flag the broad aggregate for review.
Duplicate, cover, or overlap with an earlier line	Report the first relevant ordering relationship for review.

The displayed total match slots add each line's match count. Overlapping entries can count the same address more than once, so that total is not the size of the union of all matched addresses.

Limitations and Safety Notes:

The entered patterns are processed in the browser and are not sent for remote calculation. The review covers IPv4 address relationships among the supplied lines only.

Generated lines use an IOS-style address form; verify syntax and supported wildcard behavior on the target platform.
Protocol, ports, direction, interface placement, implicit deny behavior, object expansion, and the live device configuration are outside this calculation.
Test the complete candidate ACL in an approved change process and keep a recovery path before altering production access.

Worked Examples:

A /24 network and a single host

Entering 10.10.20.14/24 normalizes the target to 10.10.20.0 0.0.0.255, because the final 8 bits are ignored and 256 addresses match. Entering host 198.51.100.42 produces a zero wildcard and one match. If a broader earlier entry covers either target, the audit points to that ordering relationship.

References:

IP Access List Overview, Cisco.
RFC 4632: Classless Inter-domain Routing, RFC Editor, August 2006.