Discontiguous Wildcard Mask Calculator

May 4, 2026

Discontiguous Wildcard Mask Calculator

Test ACL-style wildcard matches, expose sparse address gaps, and compare the target against the full bit pattern before you deploy.

💻Preset Scenarios
Standard ACL math starts with source IP matching. A discontiguous wildcard can still be valid, but the matched set may be sparse inside the numeric envelope.
⚙Wildcard Inputs
Target Match
MATCH
for target IP
Matched Addresses
0
addresses
Gap Addresses
0
sparse slots
Address Slack
0
to plan

Full Breakdown

💻Rule Engine Spec Grid
Scope
Source IP
Standard ACL
Filter a source address or sparse source group.
Wildcard style
Classic 0/1 bits
Standard ACL
Bits set to 1 float, even when they are discontiguous.
Use case
Permit / deny
Standard ACL
Common for management plane and access lists.
Action
Filter
Standard ACL
The target match decides whether the rule hits.
Contig fit
Yes
Standard ACL
Works with both prefix masks and sparse masks.
Sparse fit
Yes
Standard ACL
Discontiguous masks stay legal and countable.
Prefix fit
If contiguous
Standard ACL
A single CIDR prefix only exists for contiguous masks.
Planning note
Great for sparse sets
Standard ACL
Use the density and envelope to see the holes.
📈Reference Tables
Wildcard pattern Wild bits Match count Shape
0.0.0.255 8 256 Contiguous
0.0.3.255 10 1,024 Contiguous
0.255.0.255 16 65,536 Sparse
0.15.0.255 16 4,096 Sparse
Rule context Typical mask What it matches Why it matters
Standard ACL Source only Admin sources Protect the control plane
Extended ACL Source and dest Traffic tuples Filter flows more tightly
OSPF network statement Interface range Area membership Add interfaces to the process
EIGRP network statement Interface range AS membership Join routed interfaces to the AS
Mask type Prefix fit Address span Result
All fixed /32 1 host Exact match
Single octet float /24 256 hosts Clean block
Two-octet float /16 65,536 hosts Large block
Mixed float bits None Sparse set Discontiguous
Check Formula Meaning Signal
Match count 2^wild bits Total matched addresses Capacity
Envelope size High - low + 1 Numeric span Potential holes
Density Count / span How sparse it is Gap indicator
Slack Count - need Headroom after planning Enough or short
Tip: Check the target IP, not just the prefix.
Tip: Use binary mode to expose each floating bit.

This calculator keeps the match set, numeric envelope, and host planning separate so discontiguous wildcards stay readable instead of looking like a fake subnet.

A wildcard mask is use to determine which parts of the IP address must match a specific value. The wildcard mask can be contiguous which use a series of ones followed by zeros in the mask, or it can be discontiguous where the mask contains multiple series of ones and zero. A discontiguous wildcard mask create gaps in the IP addresses that should be permitted to match the rule.

Therefore, IP addresses that fall within the lowest and highest addresses indicated in the mask will not match the rule. In order to avoid errors in the network, it is important for network engineer to understand how a discontiguous wildcard mask work. With a contiguous wildcard mask, all of the IP addresses within a specific range will match the rule.

Wildcard Masks and IP Address Gaps

With a discontiguous wildcard mask, however, there will be IP addresses within the range that will not match the rule due to the gaps in the wildcard mask. Therefore, engineers must take this into consideration when setting up rules for a network. For instance, if a network engineer intend to permit a range of IP addresses for a specific group of computers, but the discontiguous wildcard mask leave gaps within those IP addresses, then there will be computer in that group whose IP addresses will not permit them to access the resources of the network.

In order to properly plan out a network, engineers should calculate how many hosts will be required for the network. In addition to calculating the number of hosts required, engineers should plan for the future growth of the network by adding a buffer to account for additional host that may be added in the future. Engineers can determine if they have enough addresses by calculating the slack of the network.

If the slack is a positive number, then the network has enough addresses for the current and future hosts. However, if the slack is a negative number, then there are not enough addresses for the network and the engineer will have to change the wildcard mask to include more addresses. Engineers can test a specific target IP address to ensure that the wildcard mask will work as intend.

In order for the wildcard mask to permit a target IP address, the target IP address must align with the base address and the wildcard mask. The use of the wildcard mask can differ between protocols. For instance, in OSPF, the wildcard mask is used to group interface into an area.

In EIGRP, the wildcard mask is used to define the autonomous system that the router belong to. Additionally, in extended access control lists, the wildcard mask is used to filter specific type of traffic. Many people may believe that all wildcard masks are the same than a CIDR prefix.

However, the wildcard mask is not always a CIDR prefix. With a contiguous wildcard mask, the wildcard mask acts as a CIDR prefix because it maps to a single prefix. With a discontiguous wildcard mask, however, there are multiple runs of ones in the mask which means that it does not act as a CIDR prefix.

During the design of a network, engineers should convert the wildcard mask to its view in binary. In this binary view, engineers can see any isolated ones in the mask which may create gaps in the permitted addresses. Engineers can also count the number of wild bits in the mask to determine the capacity of the wildcard mask.

Additionally, engineers should look at the envelope of the mask to determine the span of the addresses, and check the density of the wildcard mask to ensure that the engineer is not wasting any IP address. By reviewing these aspects of the wildcard mask, engineers can ensure that their deployment of the network is accuracy. Engineers must determine the gaps in the discontiguous wildcard mask prior to deploying the wildcard mask to ensure that the network function as the engineers have intended.

Discontiguous Wildcard Mask Calculator

Related posts

Leave a Comment