ACL match analysis
Wildcard Mask Calculator
Convert CIDR and subnet masks into wildcard masks, or inspect any contiguous or non-contiguous Cisco-style match pattern. Inputs and results stay in your browser.
Describe the match
Convert a CIDR or subnet mask, or analyze any Cisco-style IPv4 wildcard pattern.
Load an example
Private by default. Calculations run locally in your browser. The site does not send or save calculator inputs.
Wildcard analysis
Match expression
———
Matches every IPv4 address. Treat an any source expression as a broad policy boundary and review rule order carefully.
Match expression
- Entered address
—- Canonical comparison
—- Wildcard mask
—- Bit-check mask
—
Contiguous subnet interpretation
- Prefix length
—- Canonical CIDR
—- Subnet mask
—- Exact range
—
Non-contiguous match set
The bounds below are extrema, not a continuous range. Some addresses between them do not match.
- Lowest match
—- Highest match
—- CIDR / subnet mask
Not applicable
Bit pattern
- Pattern
—- Numeric bounds
—
0 and 1 are checked values; x marks an ignored bit.
Cisco IOS-style teaching templates
- Address / wildcard
—- Standard ACL template
—- Extended ACL template
—
Template, not deploy-ready policy.
Choose and review the platform syntax, permit or deny intent, rule order, protocol and ports, destination, interface and direction, existing policy, and implicit deny before use.
Verification aid
Test a candidate address
Check one address against this result. The candidate is not added to copied summaries or share links.
Calculation contract
Bit matching without hidden assumptions.
The calculator separates ordinary subnet conversion from arbitrary wildcard matching, so a discontinuous set is never mislabeled as one CIDR or range.
Check the value
A zero in the wildcard means the corresponding address bit must match the canonical comparison address.
Ignore the value
A one means either candidate bit may occur. Each ignored bit doubles the number of matching addresses.
Preserve valid patterns
Wildcard bits may be non-contiguous. Only trailing-one patterns receive a subnet mask, prefix, and CIDR interpretation.
Operational workflow
From subnet math to ACL review.
Use the canonical pair as a precise match expression, then supply the policy choices the calculator deliberately leaves open.
Choose the correct mode
Use CIDR or subnet-mask mode for contiguous networks. Use wildcard mode when the mask itself is the source of truth, including non-contiguous patterns.
Inspect normalization
Values in ignored address bits do not affect matching. The calculator clears those bits and shows the equivalent canonical comparison address.
Add policy context
Copyable ACL strings remain placeholders. Decide permit or deny, protocol, destination, ports, rule order, interface, and direction during policy review.
Contiguous example
192.0.2.19/27
The host-containing CIDR normalizes to one exact subnet. Its wildcard is the bitwise inverse of the contiguous subnet mask.
- Canonical CIDR
192.0.2.0/27- Subnet mask
255.255.255.224- Wildcard mask
0.0.0.31- Matching addresses
32- Lowest match
192.0.2.0- Highest match
192.0.2.31
Non-contiguous example
192.0.2.137 0.0.0.170
The ignored bits are interleaved with checked bits. The canonical comparison address is 192.0.2.1, and exactly 16 addresses match, but they do not form one continuous range.
- Canonical pair
192.0.2.1 0.0.0.170- Bit-check mask
255.255.255.85- Pattern
11000000.00000000.00000010.x0x0x0x1- Matching addresses
16 discontinuous- Lowest match
192.0.2.1- Highest match
192.0.2.171
Evidence and related tools
Cisco wildcard semantics, with subnet context.
Cisco documents wildcard zero bits as positions to check and one bits as positions to ignore. It also permits non-contiguous wildcard masks. Device families and features can still differ in accepted syntax.
Common questions
Wildcard calculator behavior
Is a wildcard mask always the inverse of a subnet mask?
A contiguous wildcard is the bitwise inverse of a valid subnet mask. An arbitrary wildcard can be non-contiguous; its inverse is then a bit-check mask, not a valid subnet mask.
What do 0 and 1 mean in a wildcard mask?
A wildcard bit of 0 checks the corresponding address bit. A wildcard bit of 1 ignores it, allowing either candidate value.
Can a non-contiguous wildcard be converted to one CIDR?
No. One CIDR describes a contiguous power-of-two block. Version 1 reports the exact predicate and match count without pretending the discontinuous set is one range.
Why did the comparison address change?
The entered value had one or more bits in positions the wildcard ignores. Clearing those bits produces an equivalent canonical expression and does not change which candidates match.
How are host and any handled?
Wildcard 0.0.0.0 becomes the Cisco-style host shorthand. Canonical 0.0.0.0 255.255.255.255 becomes any and receives an explicit all-addresses warning.
Can I paste the ACL template directly into a device?
Treat it as a teaching and documentation aid. Confirm the target platform and feature syntax, then supply policy intent, protocol, destination, ports, rule order, interface, direction, and surrounding policy.