ACL Wildcard Mask Calculator

A short access control list entry can match one host, a department subnet, a regional aggregate, or the whole IPv4 address space. In Cisco IOS-style ACLs, the wildcard mask is the address-test field that decides which packet-address bits must match the configured address and which bits may vary.

The wildcard rule reverses the subnet-mask habit many network engineers learn first. A zero bit in a wildcard means the packet address must match the configured bit. A one bit means that bit is ignored. That inverted reading is why the familiar subnet mask 255.255.255.0 turns into the ACL wildcard 0.0.0.255.

Subnet mask

Uses one bits for the fixed network portion and zero bits for the host portion.

Wildcard mask

Uses zero bits for the part that must match and one bits for the part that can vary.

Match size

Counts how many IPv4 addresses can satisfy the bit test, from one host to 4,294,967,296 addresses.

Wildcard masks matter most during change review. Notes copied from diagrams, tickets, and old device configs may use CIDR notation, a normal dotted subnet mask, a dotted wildcard mask, the host keyword, or any. Those forms can describe the same address test, but they are not equally easy to audit. A line that looks narrow in dotted decimal can still match a large aggregate or a non-contiguous bit pattern.

Contiguous wildcards map neatly to CIDR-style ranges because the ignored bits sit at the low end of the address. Non-contiguous wildcards do not. A mask such as 0.0.254.255 is a bit test, not one ordinary subnet. Cisco-style ACLs can use that kind of pattern, but it deserves closer review because dotted decimal hides which addresses will match.

The wildcard is only the address test. Final traffic behavior also depends on permit or deny action, rule order, protocol and port fields, source versus destination position, interface direction, platform syntax, and neighboring entries that match before or after the line.

How to Use This Tool:

Use the first pass to turn mixed address notes into consistent ACL targets, then use the audit outputs to decide whether each entry is narrow enough and ordered carefully enough for the change you are reviewing.

1. Choose ACL action and ACL line prefix to shape the generated IOS ACE text. Permit and deny change the line text, not the wildcard calculation.
2. Keep Mask interpretation on Auto detect dotted masks for mixed notes. Force subnet-mask mode or wildcard-mask mode when every dotted value in the list should be read the same way.
3. Paste one IPv4 entry per line in Networks and ACL patterns. The input accepts CIDR, address plus subnet mask, address plus wildcard mask, host, and any forms in one list.
4. Fix any Network input needs attention message before using the generated lines. Invalid IPv4 octets, non-contiguous forced subnet masks, malformed rows, and lists over the processing limit are reported with enough detail to find the bad entry.
5. Review ACE Lines for generated targets, Wildcard Math for binary and match-size checks, and Match Audit for broad, duplicate, covered, or overlapping entries.
6. Open ACL Address Coverage when entries differ widely in match size. The chart makes a single host, a /24, a /8, and any visibly different before you copy a rule.

If you need Cisco shorthand, switch ACE target style to use host and any. The shorthand appears only when the wildcard exactly matches a single host or the all-address pattern.

Interpreting Results:

Start with Wildcard, Match size, and Severity. A wildcard of 0.0.0.0 fixes all 32 bits and matches one host. A wildcard of 255.255.255.255 ignores all 32 bits and matches every IPv4 address. Broad contiguous prefixes such as /8 or /16 can be valid, but they should not appear by accident in a source ACL.

Match Audit is a review aid, not proof that a deployed ACL is safe. A clean audit means the entered patterns did not trigger the broadness, overlap, duplicate, non-contiguous, or normalization checks shown by the page. It does not verify sequence numbers, interface direction, protocol fields, object groups, platform defaults, or entries that are already on the device.

Take normalization seriously. If the generated target differs from the raw input, host bits were removed from a CIDR or contiguous subnet-style entry before the ACL target was generated. Copy the normalized ACL target and keep the Wildcard Math row with the change record so the reviewed address, wildcard, ignored-bit count, and match form stay explicit.

Treat overlap findings as rule-order prompts. A broader earlier match can make a narrower later match unreachable when the actions differ, while a narrower earlier match may be an intentional exception before a broader catch-all.

Technical Details:

IPv4 addresses are 32-bit values written as four decimal octets. CIDR notation makes the number of fixed leading bits explicit with a slash prefix from /0 through /32. A subnet mask writes that same continuous boundary with one bits for the fixed portion and zero bits for the host portion.

An ACL wildcard mask reverses the reading. The care mask is the bitwise inverse of the wildcard. A candidate packet address matches when every cared-about bit equals the configured ACL address after both values are masked. The ignored bits determine how many addresses can match the pattern, so one extra wildcard bit doubles the possible match size.

Contiguous wildcards behave like ordinary CIDR ranges because all ignored bits sit at the low end of the 32-bit address. Non-contiguous wildcards are different. They can match a set of addresses that share selected bits without forming one continuous range, which is why they need a bit-level review instead of a subnet-only review.

Formula Core:

For 10.10.20.0/24, the subnet mask is 255.255.255.0. Inverting it gives 0.0.0.255. The wildcard has eight ignored bits, so the match size is 2^8, or 256 IPv4 addresses.

Automatic dotted-mask detection uses a conservative heuristic. A contiguous dotted value whose first octet is at least 128 is treated as a subnet mask, except for all-zero and all-one edge values. Other dotted values are treated as wildcard masks. Forcing the parse mode removes that guess from the review when the pasted list is known to use one format.

Limitations and Safety Notes:

The output checks address-match scope only. It does not inspect a live device, confirm platform-specific syntax, test packet counters, or simulate the full ACL after it is applied to an interface or line. Use it as a pre-change review aid, then verify the final configuration on the target platform.

Only IPv4 address patterns are handled. IPv6 ACLs, object groups, named service groups, time ranges, logging behavior, route-map logic, and protocol or port fields need separate review.

The calculator processes the entered patterns in the browser after the page is loaded. Avoid putting confidential production ACLs into shared links, screenshots, tickets, or exported files unless your own change process allows that disclosure.

Large pasted lists are capped at 128 non-blank entries. When that warning appears, split the review into smaller sets so every rule is audited intentionally.

Worked Examples:

A normal /24 source range

Entering 10.10.20.0/24 produces an ACL target of 10.10.20.0 0.0.0.255. Wildcard Math shows eight ignored bits and a Match size of 256, so the line covers the addresses from 10.10.20.0 through 10.10.20.255.

A host entered with shorthand

Entering host 198.51.100.42 produces wildcard 0.0.0.0 and Match size 1. The audit may add an info row that this is a single-host match. If ACE target style is set to Cisco shorthand, the generated target stays in host form.

A non-contiguous wildcard

Entering 10.1.2.0 0.0.254.255 keeps the wildcard as an explicit bit pattern instead of turning it into one CIDR block. Match Audit marks the line for review because the matched addresses are not one ordinary continuous subnet.

A broad line that hides a later exception

If any appears before host 198.51.100.42, Match Audit flags the all-address line as Critical and can also report that the host line is covered by the broader earlier line. That does not prove the ACL is wrong, but it is the cue to verify sequence order and action before applying the change.

A malformed dotted value

If a line has an invalid IPv4 octet or a forced subnet mask with non-contiguous one bits, the error list names the line that needs attention. Fix the input before using the IOS ACE output, because partially parsed lists can hide the rule that actually needs review.

FAQ:

References:

• IP Access List Overview, Cisco.
• RFC 4632: Classless Inter-domain Routing (CIDR), RFC Editor, August 2006.