TechKnowSurge
Cisco CCNA 1.6 Cisco CCNA 5.6
TechKnowSurge Catalog Videos Wildcard Masks
VideoNetworkFree

Wildcard Masks

Wildcard masks define which bits in an IP address a router must match and which it can ignore, making them essential for routing protocols like OSPF and access control configurations.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wildcard masks operate on the same 32-bit binary structure as IP addresses, with each bit position holding either a zero or a one. A zero in a wildcard mask means the corresponding bit in the IP address must match exactly, while a one means that bit is ignored — functioning similarly to a wildcard character in search patterns or regular expressions. This makes wildcard masks the logical inverse of subnet masks, which use ones to mark significant network bits and zeros to mark the host portion. The practical application of wildcard masks depends on the level of specificity required. An all-zeros wildcard mask targets a single host or interface, requiring every bit to match precisely. A wildcard mask that mirrors the host portion of a subnet mask targets an entire network, allowing any value in the host bits. A broader wildcard mask can encompass a summary range that spans multiple subnets, which is useful when configuring routing protocols like OSPF to activate on all interfaces within a larger address space such as 10.0.0.0/8. Understanding wildcard masks is foundational to advanced network configuration. They appear in OSPF network statements, access control lists, and other IOS features where granular address matching is required. Misreading or misapplying a wildcard mask can result in unintended interfaces participating in routing processes or incorrect traffic filtering, making precision with this concept critical for any network professional.

What you'll learn

What's covered

Wildcard Masks Deep Dive

Aligned to

Cisco CCNA
1.6 Configure and verify IPv4 addressing and subnetting
5.6 Configure and verify access control lists

Key terms

Wildcard Mask
A 32-bit mask used in ACL statements and OSPF network commands where a 0 bit means the corresponding address bit must match and a 1 bit means it can be anything. Wildcard masks are the inverse of subnet masks and allow a single statement to match an entire range of IP addresses.
Subnet Mask
A 32-bit number that divides an IP address into network and host portions.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Subnet
A logical subdivision of an IP network, used to organize and segment network traffic.
Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.

Transcript

In a prior video I covered wildcard masks, but I briefly covered it and I said I would get a little more in depth into it. So let's get a little more in depth into it now.

Now, it's important to really understand what a wildcard mask is and how it operates, and not just because of the network statements that we're creating now. In fact, it's going to become more important as we go along into other modules. So make sure you get it down now. So let's get a little more in depth into what a wildcard mask is.

Binary representation of an address

An address has 32 bits, and each of those bits is a one or a zero. And so if I were to represent 10.1.10.34, I would come up with 00001010, and this will be all zeros with the last one being a one, and this would repeat that 00001010, and 34 would be represented by 0 0 1 1 0 — let's see, is that enough zeros or enough digits there? Two, four, six, eight. Yes, okay. So that is the binary equivalent to 10.1.10.34.

Subnet mask versus wildcard mask

So that is an IP address. What a subnet mask did is it told us which were the network bits and which were the host bits. So in this case right here, I would enter in that this was all network bits here, and that would be represented by one — it would say that these are network bits. And same thing with this, those are all network bits. And then same thing with all this, these are all network bits. And then these are host bits. So in some senses this is saying, well, this doesn't represent the network, or this doesn't really matter, I'm going to ignore those last ones. It's not quite what it's saying, but this is the network portion of this, and this is the host bit portion of this. And what we come up with is 255.255.255.0.

A wildcard mask is somewhat similar, and a lot of times what we're going to see is the wildcard mask is the opposite of the subnet mask. So in this case right here, if we're specifying this network that this is on, we would say that these are all host bits — or what the ones represent is, it doesn't matter if that's a one or a zero, we're going to ignore those. It's similar to wildcards in things like programming, or in certain software you'll use wildcards to say I want to search for something, or I want to eliminate all of these options, or use wildcards as a wildcard. And so these all essentially turn this into ignoring that part of it. And then these would all be zeros across here, saying that those are the ones that we are concerned about, that we want to see.

So what we end up with, the wildcard mask, once again, is the opposite of a subnet mask.

When wildcards are not simply the opposite

Now, I say wildcards generally are the opposite of the subnet mask. So let's take a look at why I say generally. So here's an IP address right here, and that IP address has those bits to it. And I've already said, if I'm going to do the network itself, or the network that this is on, this would be the network that it's on right here. This would be the wildcard mask for representing that network, saying that all of the last bits don't really matter, so it's really anything that's on that network.

However, there are times when I want to specify a single host or a single interface. And so to do that, I say that all the bits matter, there are no wildcards, so that is all zeros. So I use all zeros if I want to specify a specific host. Or, an example with our OSPF: if I want to specify a specific network interface that I want to send OSPF packets on, then I could use these all zeros on it.

All right, there are times when I want to do something greater than just the individual network. The example of this is when we did my first demo on OSPF configurations. In that case right there, I wanted to specify all of the networks and all of the interfaces. It was greater than any one subnet. So I'm calling this the summary. This summary is something that's greater than any one network there. So this is all that the networks fall under here. I'm saying that it's anything in that 10.0.0.0 range, that all of the bits in that slash 8 network are wildcard, and so any of those networks, any of those interfaces, would be fair game, I guess, in that case right there.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →