PracticeLabs
Week 20%

Lesson 3 — Wildcard Masks

Week 2Lesson 3Required14 min estimated0% progress

Wildcard Masks

Turn a subnet mask into its wildcard inverse and read what an address plus wildcard actually matches — the notation access lists and OSPF reuse later in the course.

Lesson orientation

What you'll learn (4 objectives)~14 min: video → lesson → check → apply → lab prep

Learning objectives

  • Compute a wildcard mask as the inverse of a subnet mask by subtracting each octet from 255
  • Interpret which address bits a wildcard requires to match and which it ignores
  • Write the wildcard that matches an entire subnet, a single host, and any address
  • Explain why access lists and OSPF network statements take wildcards rather than subnet masks

Terms you will see

Wildcard maskInverse maskDon't-care bithost keywordany keyword

Time breakdown

  • Read the notes9 min
  • Worked conversions and prediction5 min

A wildcard is the mask inverted

A subnet mask uses 1 bits to mark the network portion. A wildcard mask does the opposite: 0 bits mark the part of the address that must match, and 1 bits mark the part to ignore. Numerically it is the mirror image, so you compute it by subtracting each mask octet from 255.

Subnet mask to wildcard, by prefix
PrefixSubnet maskWildcardWhat it matches
/24255.255.255.00.0.0.255one /24 — 256 addresses
/25255.255.255.1280.0.0.127one /25 — 128 addresses
/26255.255.255.1920.0.0.63one /26 — 64 addresses
/27255.255.255.2240.0.0.31one /27 — 32 addresses
/28255.255.255.2400.0.0.15one /28 — 16 addresses
/30255.255.255.2520.0.0.3one /30 — 4 addresses
/32255.255.255.2550.0.0.0exactly one host
/00.0.0.0255.255.255.255every address
You already know these numbers
Look down the wildcard column: 255, 127, 63, 31, 15, 3. Those are the block sizes from Lesson 2, each minus one. That is not a coincidence — a subnet's wildcard is precisely its host-bit range, so the wildcard for any prefix is its block size minus one. If you can find a block size, you can write a wildcard without a subtraction table.

Reading what an address and wildcard match

Pair an address with a wildcard and evaluate it bit by bit. A 0 in the wildcard means this bit of the address must match. A 1 means don't care. So 192.168.1.0 with wildcard 0.0.0.63 requires the first three octets and the top two bits of the fourth to match, while the low six bits are ignored — which is every address from 192.168.1.0 through 192.168.1.63, exactly the /26 subnet.

The same works when the boundary is further left. A /20 has mask 255.255.240.0, so its wildcard is 0.0.15.255 — the third octet may vary across 16 values and the fourth across all 256. Applied to 10.55.16.0, that matches 10.55.16.0 through 10.55.31.255, which is the /20 range computed in the previous lesson.

The most common wildcard error
Do not read a wildcard like a subnet mask. Here 0 means must match and 1 means ignore, which is the reverse of everything you have done this week. Reversing them turns a rule that matches one subnet into one that matches almost everything else, and access lists fail in ways that look like routing problems.

The two shortcuts you will use constantly

  • A wildcard of 0.0.0.0 forces every bit to match, so it identifies a single host. Cisco lets you write host 10.1.1.1 instead, and the two forms are equivalent.
  • A wildcard of 255.255.255.255 ignores every bit, so it matches anything. Cisco lets you write any, and again the two forms are equivalent.

Access lists and OSPF network statements take wildcards rather than subnet masks, which is the entire reason this lesson sits here rather than in the week those topics appear. When you reach Week 5 and write your first access list, the notation will already be familiar and the only new material will be the filtering logic.

What you should retain

  • Wildcard = 255 − each subnet mask octet, the bit-inverse of the mask.
  • In a wildcard, 0 means must match and 1 means ignore — the opposite of a subnet mask.
  • A subnet's wildcard is its block size minus one, so /26 gives 0.0.0.63.
  • 0.0.0.0 matches exactly one host; 255.255.255.255 matches any address.
  • Access lists and OSPF consume wildcards, so this notation returns in Weeks 5 and 7.
Pause and predictNot scored — nothing is recorded

Before you read on

Write the wildcard mask for a /27 subnet, and say what address range 172.16.8.64 with that wildcard matches.

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

IP Addressing & Subnetting

For the wider CIDR and mask reference — useful if you want more mask-to-wildcard pairs than the table above

Open guide