Wild Card Masks – How to

One of the concepts that I initially struggled with was wild card masks.  They just didn’t make any sense to me.  I couldn’t understand them and the examples in the Cisco press book just pushed that frustration further.  And then one day, while studying for the CCNA, it just clicked.  I thought I’d try to explain them in my own words so that other people might be able to benefit from, what I think is, a simpler way to look at them.

What is a wild card mask?
Wild card masks are used for a variety of different tasks.  OSPF area definitions and some access lists use them to define a certain part of the network.  They work much like subnet masks but in reverse.  For instance, take this Class C subnet.

192.168.127.1 /24
Network – 192.168.127.1
Subnet mask – 255.255.255.0
Wild Card Mask – 0.0.0.255

Pretty straightforward right?  The wild card mask is essentially the reverse of the subnet mask.  So if the binary subnet mask looked like……

11111111.11111111.11111111.00000000

The wild card mask would look like this…..

00000000.00000000.00000000.11111111

That’s all fairly easy to understand, however when you start using VLSM it can get a little trickier.  For instance, take this class C subnet.

192.168.127.1 /27
Network – 192.168.127.1
Subnet mask – 255.255.255.224
Wild Card Mask – 0.0.0.31

The binary would look like this…..

11111111.11111111.11111111.11100000

The wild card mask would look like this…..

00000000.00000000.00000000.00011111

Now that’s a little more confusing isn’t it?  What might even be harder to understand is if you were simply given this…

access-list 1 permit 192.168.127.1 0.0.0.31

The Cisco book I read suggested that you do the binary conversion to figure out what exact network that ACL represented.  That seems like a waste of time to me.  Why not just subtract the wild card octets from 255.255.255.255.  In other words….

     255.255.255.255
   –     0.     0.     0.  31
—————————
     255.255.255.224

Then to convert a mask from standard notation to wild card you simply subtract the subnet mask from 255.255.255.255. 

    255.255.255.255 
-  255.255.255.224
————————— 
          0.     0.     0.  31

Wasn’t that easy?  Now I know some of you sitting out there reading this are thinking to yourself “Wow, we all knew that already”.  But for someone who has just be introduced to wild card masks this could be a huge help.  If someone would have just told me that I could just subtract as shown above it would have saved me one or two nights of frustration.  I think the Cisco press books meant well by trying to show you the full binary math behind wild card masks – and I’m not saying you should learn the binary way of doing this as well – but knowing the quickest way to do something is often far more helpful (especially on exams!).