Wildcard Mask

A wildcard mask is an inverted subnet mask used to match ranges of IP addresses in access control lists (ACLs), routing protocols and other forms of network filtering. Instead of describing how a subnet is structured, it describes which bits of an address must match exactly and which bits are allowed to vary.

The key difference is bit semantics: a subnet mask uses 1 bits to mark the network portion and 0 bits for the host portion, while a wildcard mask is the inverse — 0 bits mark the bits that must match, and 1 bits mark the bits that are ignored. This inversion makes wildcard masks well suited for expressing flexible match conditions instead of strict network boundaries.

In practice, the wildcard mask for a /24 subnet with subnet mask 255.255.255.0 is 0.0.0.255. A typical Cisco-style ACL entry such as permit ip 192.168.1.0 0.0.0.255 any therefore matches every host in 192.168.1.0/24. By choosing different wildcard masks, the same syntax can match individual hosts, contiguous ranges, or non-contiguous patterns that a normal subnet mask cannot express.

Wildcard masks are tightly related to subnets, CIDR notation and prefix length, and are widely used in routing protocol configuration (such as OSPF network statements) and ACLs on routers and firewalls. They operate on IPv4 IP addresses and complement, rather than replace, standard subnet masks.