ACL Address Match Tester
Test an address against supplied rules.
ACL Address Match Tester: inputs and results
Enter an IP address, CIDR prefix, or range. Then check its first and last address below.
Calculated Boundaries & ParametersReady
Key Capabilities
- •100% Client-Side: Zero telemetry or server latency.
- •RFC Compliant: Exact 32-bit and 128-bit integer precision.
- •Quick Copy: Instant access to CIDR, mask, and range bounds.
- •Cross-Platform: Works on desktop, tablet, and mobile browsers.
Related Masks, Wildcards & ACLAll Tools
IP Address and Mask Calculator
Calculate the corresponding network range.
CIDR to Subnet Mask Converter
Convert IPv4 prefixes to dotted masks.
Subnet Mask to CIDR Converter
Find prefix length from contiguous masks.
Subnet Mask Validator
Check mask structure and contiguity.
Subnet Mask to Wildcard Converter
Calculate the inverse IPv4 mask.
Wildcard Mask to Subnet Mask Converter
Convert compatible contiguous wildcard masks.
How ACL Address Match Tester Works?
The ACL Address Match Tester works by evaluating rules in sequence order, stopping at the first rule that matches the address, and applying an implicit deny when no rule matches.
Enter the rule list
Paste the ACL entries with sequence numbers, actions, base addresses, and wildcards.
Enter the test address
Type the address to evaluate, such as
10.1.1.5.Walk the rules in order
The tester checks rule 10, then rule 20, and onward. The first match ends the walk.
Report the decision
The tester returns the matching sequence number and the action. No match returns the implicit deny.
ACL Address Match Tester Formula
The ACL Address Match Tester formula is Decision = Action of the first rule i where (A AND NOT W_i) = (B_i AND NOT W_i), else deny.
Rule match
(A AND NOT W_i) = (B_i AND NOT W_i)Per-rule wildcard test.
First match
min(i) where rule i matchesOrder decides the result.
Implicit deny
No match → denyStandard behavior on Cisco and most firewalls.
Worked example: 4-rule ACL, address 10.1.1.5
10 deny host 10.1.1.5 → match ✓ → DENY 20 permit 10.1.1.0 0.0.0.255 (not reached) 30 deny 10.1.0.0 0.0.255.255 (not reached) 40 permit 10.0.0.0 0.255.255.255 (not reached)
ACL Address Match Tester Conversion Table
The ACL Address Match Tester conversion table evaluates 10 addresses against the 4-rule ACL in the worked example and shows the deciding rule and action.
| Address | Deciding Rule | Action |
|---|---|---|
| 10.1.1.5 | 10 | deny |
| 10.1.1.6 | 20 | permit |
| 10.1.1.255 | 20 | permit |
| 10.1.2.5 | 30 | deny |
| 10.1.255.1 | 30 | deny |
| 10.2.0.1 | 40 | permit |
| 10.200.5.5 | 40 | permit |
| 11.0.0.1 | implicit | deny |
| 192.168.1.1 | implicit | deny |
| 10.0.0.1 | 40 | permit |
Rules: 10 deny host 10.1.1.5 · 20 permit 10.1.1.0 0.0.0.255 · 30 deny 10.1.0.0 0.0.255.255 · 40 permit 10.0.0.0 0.255.255.255 · implicit deny.
What is ACL Address Match Tester?
The ACL Address Match Tester is a tool that shows which rule in an ordered Access Control List (ACL) decides the fate of a given IPv4 address, and whether that address is permitted or denied.
ACLs are processed top-down. The first matching entry wins, and every later entry is skipped. A broad permit placed above a narrow deny hides the deny completely. The tester exposes those ordering effects one address at a time.
Every standard ACL ends with an invisible "deny any". The tester reports that implicit deny explicitly, so an unmatched address never looks permitted by mistake.
What are the uses of ACL Address Match Tester?
There are 4 main uses of the ACL Address Match Tester, including pre-change testing, shadowed rule detection, and incident response.
Testing ACL changes
Engineers run key addresses through the new ACL before applying it to an interface.
Finding shadowed rules
Rules that never decide any test address point to entries hidden by earlier rules.
Answering access requests
Support teams check whether a requester address is already permitted.
Investigating blocked traffic
The tester shows which rule dropped a flow seen in logs.