Home / Network Fundamentals / Understanding Wild Card Masks

Understanding Wild Card Masks

wildcard maskMany engineers (at one time myself too) believe they understand wild card masks. If you ask someone they will most likely tell you that a wild card mask is just the opposite or reverse of a subnet mask. Unfortunately this isn’t quite correct. Yes, at first glance a wild card mask “looks” like the reverse and in some ways it really is. But a wild card mask can do so much more. I hope to explain in this article what a wild card is and how we can use it more effectively.

As the name states, a wild card mask matches (wildly with a zero) everything in the network portion of an IP address. As we dive into how this works it will becomes a bit more clear exactly how a wild card mask works and how we can use it.


So there are two basic rules of a wild card mask.

  • 0-bit = match
  • 1-bit = ignore


What can wild card masks target?

  • A single host (or a single IP address)
  • An entire network (i.e, Class A, B, or C)
  • An entire subnet
  • A range of IP addresses

Got it so far? …Good.  But, what does this mean? How does it work?

Keep reading…

Targeting a Single Host

To target a single host with a wild card means that every bit within the IP address of the host must match. The bit that means we are matching is a zero (0-bit).  So a wild card mask for a host would be —

Targeting an Entire Network

To target an entire network means that every bit within the NETWORK portion of the IP address must match.  All others we can ignore.  So for a Class-C network (i.e., the wild card mask would be —

Targeting a Subnet

To target a particular subnet (not classful) we will still need to match on  every bit on the NETWORK portion, however now we need to find the proper bit boundary in the last octet used by our network.  So for example we need to find the wild card mask for the network   The easiest way to do this is to simply subtract the subnet mask ( from minus equals a wild card mask of —

Targeting a Range of IP Addresses

To target a range of IP address is where we begin to see how the wild card mask is different from just a reverse of a subnet mask.  The same rules apply 0-match, 1-ignore.  If we have a range of through we can match at the 23rd bit.  This would allow only the two networks to be targeted.  The wild card mask would be

Writing this out in binary helps. We know we want to match on the entire 1st and 2nd octets.  That part is easy – both are zero’s.  Its the third octet that is the trick. Lets break that third octect out in binary

192 168.0.  ---- binary  00000000
192.168.1.  ---- binary  00000001

If you look here the bit we want to match on is the 23rd bit. The subnet mask for a slash 23 is  We then subtract it from to get our wild card which is

Pretty cool huh?

Target all even Networks or all odd Networks

With what we’ve learned so far, you might be able to see the possibilities.  So now lets take this one last step further.  Lets target just all even networks. (definitely a CCIE lab scenario)

Let say we need to route all even networks in the block of space. Where can we match within the third octet that will allow us to do this.  Once again we need to break it out in binary to see it more clearly.

192 168.0. ---- binary 00000000
192.168.1. ---- binary 00000001
192.168.2. ---- binary 00000010
192.168.3. ---- binary 00000011
192.168.4. ---- binary 00000100
192.168.5. ---- binary 00000101
192.168.6. ---- binary 00000110
192.168.7. ---- binary 00000111

If look you can see the last bit of the third octet (bit 24) is a zero for every even network.  The value for this bit is 1. We can match on this last bit to target the even network by taking the inverse of 1 to get 254. (255-1).

The wild card mask for this would be



I’m sure your head is swimming about now, but I hope you can see the power of wild card masks and how they are different from subnet masks.

Do you have problems with wild card masks?  Do you have a cool way to figure out wild cards mask or a cool trick you can use wild card masks for?  Leave us a comment and let us know what you think?  It comments that brings websites like these to life.  I’d love to hear what you think.


About Joe

Senior Network Engineer, technology enthusiast, guitar and bass player. Joe Wilson is the creator of RouterFreak.com as well as other niche websites that can be found around on the Internets.

Check Also


What is Internet of Things (IoT) and how is it changing our lives?

Networks, as we know them, have changed over the past few years and there is …


  1. Hi Sir,

    Awesome explanation, In Targeting a Range of IP Addresses section, how IP address (Class C) will will be under subnet mask? it should be like 255.255.255.*** (/>24) right? please correct me if i am wrong.

  2. Thanks Joe, thanks to your help I might actually be able to ace the exam I have in a week 😀
    Very clear! Would be cool if you had some more advanced examples but still very very good!

  3. Awesome explanation!!!Ty

  4. Very clear explaination. Thank you very much.

  5. If this article is still alive and being monitored, please go over wildcards that target more than one subnet.

  6. In the “Target All Even Networks . . .” section, you state that “The wild card mask for this would be”

    This is obviously wrong, since it’s not possible to have a value of 254 in a wildcard mask. The correct wildcard mask to achieve this result would be

    • Ignore previous post. My apologies, I get it now. However, it might be helpful to explain in more detail what’s actually happening here, and the fact that a Wildcard mask doesn’t always have to be a contiguous block of binary “1”s starting from right to left. Unfortunately, this is how Cisco explains it to most newbies, so when a “binary mask” is used to target specific addresses or networks, it can get confusing. Thanks for the great article.

  7. Hello.
    You say: To target a range of IP address is where we begin to see how the wild card mask is different from just a reverse of a subnet mask.

    But I think it is not true. Because /23 is also a subnet. If we get the reverse of /23, we find the Wildcard Mask. That’s why we will be targeting the subnet.

    So how different from just a reverse of a subnet mask it can be?

    • Saith

      Its true that is the same as /23. But to match all even subnets is an example of a wildcard mask differing from a subnet mask

  8. I would like to say thank you for this post, it has been very helpful and is very clear.

  9. Good one nice..but still it is reverse of subnet mask no strong logic to support ur starting statement that they r not

    • For most cases day to day NetEng stuff, yes the wild card is simply the reverse of the Subnet mask. However if you need to split routing, as in the example, to send traffic for even networks one direction and all odd networks another direction, you will have to use a wild card mask. Hence the name wild card which causes the router to match all entries in the routing table on the wild card bits.

      HINT – this may be on the CCIE exam.

  10. hi sir ..

    i want to why we need wildcard mask n acl .. some one know about ASA .. ASA doesn't support Wildcard still we r using ACL n EIGRP this service n it's working properly so why we need wildcard in router ?

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.