I've always wondered what the use of wild card masks was. When I learned about them in college I wondered what the use was, we saw that you could separate subnets by for instance even and uneven IPs. What is the practical use of wild card masks vs normal subnet masks?

  • So basically the wild card mask bypasses the uses of a subnet mask because its easier is binary to calculate because of reverse binary.
    – user24602
    Apr 15, 2016 at 18:48
  • Little mistyping there. But binary speaking its use is easier then a standard subnet mask?
    – user24602
    Apr 15, 2016 at 18:50

4 Answers 4


As I understand it, the question is what is the reason for the two different masks, not what are the differences between the masks. The two questions overlap somewhat, but it comes down to binary math (as YLearn hits on).

First, a netmask:

IP:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0100 =
Mask: 1111 1111 . 1111 1111 . 1111 1111 . 1111 1000 =
AND:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 =

The AND operation on the IP address with the netmask results in the network

Next, a wildcard:

NET:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 =
WC:   0000 0000 . 0000 0000 . 0000 0000 . 0000 0111 =
OR:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0111 =

performing an OR operation on the network results in the range of IPs ( that may be permitted or blocked in an ACL or OSPF network statement (remember that OSPF only looks for interfaces that fall within the specified ranges -- i.e. it doesn't match IP and netmask, just the IP). It's very easy to check whether an IP is in range with:


This is useful to the router because the netmask does not easily give you this information (without additional operations).


There are some odd corner cases you can do with wild card masks that are difficult to do with subnet masks - for example, you could do 1.2.*.4 easily in a wild card mask that would be hard to do in a subnet mask. How practical this is is left up to the operator in question.

Basically a wild card mask splits up each bit into a 'match' or 'don't care' setting. if you have for example, that would translate to '11111111.11111111.11111111.00100001'. If the original IP was, this translates to 00000001.00000001.00000001.10001000. Using the example given, which is starting to make my brain hurt from doing binary math, only the 3 and 8th bit of the last octet would have to match the original IP in order to be a pass (along with the other 3 octets).

  • Indeed that's what I was wondering about what the practical uses are May 21, 2013 at 21:19
  • - pretty simple if you ask me
    – Olipro
    May 21, 2013 at 22:26
  • 1
    That's not a valid subnet mask. May 21, 2013 at 22:30
  • 2
    it's perfectly valid, it's just not valid for the purposes of configuring an address in a CIDR-based environment. On a firewall or other system that doesn't care about it being a longest-prefix compliant mask, it's completely valid. iptables or an access-list are a good example. Computers aren't magic, 1.2.x.4 is identical to in terms of bitmasking, it's the difference between a regex and a logical AND.
    – Olipro
    May 22, 2013 at 0:45
  • 1
    Don't try to play semantics with me, "subnet mask" and "wildcard mask" are equally misnomers. Nowhere did I use the word "subnet mask" in my statement. a mask is a mask, what matters is its purpose.
    – Olipro
    May 22, 2013 at 1:34

Wildcard masks are also used to specify source/destination subnets (or specific addresses) in access control lists. They're also used to specify protocol interfaces that OSPF will use in more "traditional" versions of IOS (NX-OS and probably IOS-XR notwithstanding).

edit: A subnet mask's job is to separate host bits from network bits. The number of 1's in the subnet mask has to be contiguous.

11111111.11111111.00000000.00000000 <-- valid subnet mask (/16)
11111111.11111111.11111000.00000000 <-- valid subnet mask (/21)
11111111.11111111.00111000.00000000 <-- whoops, invalid subnet mask

Wildcard masks are not bound by this rule (hence the term "wildcard"), therefore you can do things like Aaron had mentioned, ie:

access-list 1 permit

This will permit:
  • Alright but why can't regular subnets not address this? May 21, 2013 at 21:53
  • 1
    A subnet mask does nothing more than to separate host bits from network bits. It must be contiguous. You do not have this restriction with wildcard masks - hence the term "wildcard." This makes them better suited for more arbitrary host or network specification. May 21, 2013 at 21:56
  • @JohnJensen nice description of the "wildcard". Makes me remember it better :) You should put this in the original answer!
    – Bulki
    May 21, 2013 at 22:37
  • I've amended my answer to include this - not sure if you meant mine or Aaron's though. May 21, 2013 at 22:44
  • @JohnJensen I meant yours :) (just like you edited)
    – Bulki
    May 22, 2013 at 5:22

They are somewhat a hold out from when bits were precious and processing data in certain ways (binary AND or binary OR) was less taxing.

Today, they are still useful in other cases, as Aaron has already mentioned.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.