Subnet mask vs wildcard mask: stop mixing them up
A wildcard mask is not a subnet mask, and using one where the other belongs quietly matches the wrong addresses. The good news: they are exact inverses, so once the relationship clicks you never have to guess again.
They are inverses of each other
A subnet mask marks the network bits with 1s: /24 is 255.255.255.0. A wildcard mask marks the bits to ignore with 1s — it is the bitwise inverse of the subnet mask. So /24 becomes wildcard 0.0.0.255. A 1 in a wildcard means "this bit can be anything"; a 0 means "this bit must match."
Where each one belongs
- →Subnet mask: interface addressing, subnet math, DHCP scopes.
- →Wildcard mask: Cisco ACLs, OSPF network statements, and route-maps.
access-list 10 permit 10.0.0.0 0.0.0.255 ! matches 10.0.0.0/24 network 10.0.0.0 0.0.0.255 area 0 ! OSPF: enable on 10.0.0.0/24
The /12 trap
The most common mistake is the RFC1918 172.16.0.0/12 block. Its subnet mask is 255.240.0.0, so the wildcard is 0.15.255.255 — not 0.0.255.255. Writing the wrong one leaves guest or internal-deny rules matching a fraction of the range they should. When in doubt, convert it rather than trust muscle memory.