Demystifying Wildcard Masks

1. What is a Wildcard Mask?

Wildcard masks tell a routing process or an ACL block which bits of an IP address to care about and which bits to completely ignore. Unlike subnet masks where binary 1s indicate a match, wildcard masks use binary 0s to represent strict matching rules.

• Binary 0: Check this bit. It must match perfectly.
• Binary 1: Ignore this bit. It can be a 0 or a 1.

2. The "Inversion" Shortcut

For standard subnets, you can find the wildcard mask easily by subtracting your regular subnet mask from 255.255.255.255.