CIDR to Wildcard Mask Converter

A wildcard mask is the subnet mask inverted bit by bit. Where the mask has a 1, the wildcard has a 0, and the other way round. It exists because Cisco gear uses that form in access lists: instead of writing 255.255.255.0, the ACL wants 0.0.0.255. Anyone juggling both formats in the same afternoon eventually swaps one for the other, and the ACL starts permitting a great deal more — or a great deal less — than intended.

Enter just the prefix length, from 0 to 32, and the page returns both forms at once: the subnet mask and the matching wildcard. A /24 gives mask 255.255.255.0 and wildcard 0.0.0.255. A /30, common on point-to-point links, gives 255.255.255.252 and 0.0.0.3. And a /32, which identifies a single host, gives 255.255.255.255 with wildcard 0.0.0.0.

It helps to keep the meanings apart: in a mask, the bits set to 1 mark the fixed part of the address; in a wildcard, the bits set to 1 mark the part that may vary — the bits the device should ignore when matching. Some platforms also accept discontiguous wildcards for odd/even matching, but those do not come out of a CIDR prefix and are not generated here.