ACL Wildcard Match Calculator
Evaluate address-and-wildcard matching.
ACL Wildcard Match Calculator: inputs and results
Enter an IP address, CIDR prefix, or range. Then check its first and last address below.
Calculated Boundaries & ParametersReady
Key Capabilities
- •100% Client-Side: Zero telemetry or server latency.
- •RFC Compliant: Exact 32-bit and 128-bit integer precision.
- •Quick Copy: Instant access to CIDR, mask, and range bounds.
- •Cross-Platform: Works on desktop, tablet, and mobile browsers.
Related Masks, Wildcards & ACLAll Tools
IP Address and Mask Calculator
Calculate the corresponding network range.
CIDR to Subnet Mask Converter
Convert IPv4 prefixes to dotted masks.
Subnet Mask to CIDR Converter
Find prefix length from contiguous masks.
Subnet Mask Validator
Check mask structure and contiguity.
Subnet Mask to Wildcard Converter
Calculate the inverse IPv4 mask.
Wildcard Mask to Subnet Mask Converter
Convert compatible contiguous wildcard masks.
How ACL Wildcard Match Calculator Works?
This tool works by ignoring every bit position where the wildcard has a 1 and comparing the remaining bits of the test address with the base address.
Enter the base address
Type the ACL base address, such as
192.168.0.0.Enter the wildcard
Type the wildcard, such as
0.0.254.255.Enter test addresses
Paste 1 or more addresses to test.
Compare the care bits
For each address, the calculator clears the wildcard bits in both values and checks for equality.
ACL Wildcard Match Calculator Formula
The formula is Match = (Address AND NOT Wildcard) = (Base AND NOT Wildcard).
Care bits
C = NOT WBit positions that must match.
Match test
(A AND C) = (B AND C)True when every care bit matches.
Matching address count
2^(number of 1 bits in W)For 0.0.254.255: 2^15 = 32,768.
Worked example: 192.168.0.0 0.0.254.255
Octet 3 wildcard 254 = 11111110 → only the last bit is checked Base octet 3 = 0 → last bit must be 0 (even) 192.168.4.10 → 4 is even → match 192.168.5.10 → 5 is odd → no match 10.168.4.10 → octet 1 differs → no match
ACL Wildcard Match Calculator Conversion Table
The table tests 10 addresses against 192.168.0.0 0.0.254.255, a rule that matches even third octets in 192.168.0.0/16.
| Test Address | Octet 3 Binary | Result |
|---|---|---|
| 192.168.0.1 | 00000000 | Match |
| 192.168.1.1 | 00000001 | No match |
| 192.168.2.200 | 00000010 | Match |
| 192.168.3.200 | 00000011 | No match |
| 192.168.100.5 | 01100100 | Match |
| 192.168.101.5 | 01100101 | No match |
| 192.168.254.9 | 11111110 | Match |
| 192.168.255.9 | 11111111 | No match |
| 192.169.0.1 | 00000000 | No match |
| 10.168.4.10 | 00000100 | No match |
What is ACL Wildcard Match Calculator?
The ACL Wildcard Match Calculator is a tool that tests whether an IPv4 address matches an ACL entry written as a base address and a wildcard mask.
Wildcard masks tell a router which bits to check and which bits to ignore. A 0 in the wildcard means the bit must match the base address. A 1 means any value is accepted. Contiguous wildcards match subnets, and non-contiguous wildcards match patterns such as "all even subnets".
Non-contiguous patterns are hard to read by eye. The calculator shows the binary comparison for each address, which removes guesswork from ACL reviews.
What are the uses of ACL Wildcard Match Calculator?
There are 4 main uses of the ACL Wildcard Match Calculator, including ACL testing, pattern rules, and security reviews.
Testing ACL entries before deployment
Engineers confirm that a new entry matches the intended hosts and no others.
Building pattern-based rules
Rules such as "every .1 gateway in 10.0.0.0/8" use
10.0.0.1 0.255.255.0.Reviewing inherited ACLs
Old ACLs with odd wildcards are tested address by address.
Explaining OSPF network statements
The calculator shows which interface addresses an OSPF wildcard selects.