Verification
Wildcard mask calculator and ACL match checker
Check whether an IPv4 address matches an ACL pattern and wildcard mask. Compare contiguous and non-contiguous masks with the bits explained.
New to this tool? Start here.
Click an example below the form. Look at the result, then change one value to compare what happens.
- Wildcard
- An address-matching mask: a 0 bit must match and a 1 bit is ignored. For example, 0.0.0.255 allows any last number in the address.
- ACL
- A list of rules that allow or block network traffic. This calculator checks an address pattern, not the behaviour of an entire list.
01 / Input
Start with your data
Your data is processed in the browser. Sharing a result is your choice.
02 / Your result
A result you can understand.
Fill in the form or choose an example. You will see the values and how they were calculated.
02 / Your result
Step by step
How did we get here?
How to use it
A wildcard 0 bit must match; a 1 bit is ignored. Not every wildcard mask can be represented by a single CIDR prefix.
A little network lab
Which address bits must match?
Check pattern 192.168.1.0 with wildcard 0.0.0.255 against 192.168.1.42. This is an address-matching exercise, not a full ACL configuration.
Zero wildcard bits require a match. The first three octets must therefore be exactly 192, 168 and 1.
255 is eight one bits. The last octet is ignored, so it may have any value from 0 to 255.
Address .42 matches. Address 192.168.2.42 does not, because the third-octet difference is not ignored.
Your turn
What does wildcard 0.0.0.0 mean?
Show answer and explanation
Every bit must match. The pattern matches one exact address.
Official documents
Standards & sources
Sources checked:
The date refers to checking the listed documents and registries, not endorsement by their authors. Calculation assumptions and limits appear with the result. How we prepare the material.