Why Cisco ACLs and OSPF invert the mask

A subnet mask and a wildcard mask encode exactly the same information — which bits are "network" and which are "host" — just inverted. A subnet mask says "these bits must match to be in the network" with 1s; a wildcard mask says "these bits are don't-care" with 1s, which is the opposite convention. Classic Cisco IOS syntax for access-control lists and OSPF network statements adopted the wildcard convention rather than the subnet-mask one, which is a frequent source of ACLs that silently match the wrong traffic when someone pastes in a subnet mask (255.255.255.0) where the device expects a wildcard mask (0.0.0.255), or vice versa — the numbers look similar enough at a glance to swap by mistake.

Discontiguous wildcard masks are a real, separate feature

This tool only accepts contiguous masks (a clean run of 1s or 0s), which covers the vast majority of real use — but Cisco ACLs technically allow discontiguous wildcard masks too, like 0.0.15.240, which don't correspond to any valid CIDR prefix at all. Those are used deliberately for matching non-contiguous bit patterns across an address (for example, matching every 16th VLAN in a numbering scheme) rather than a simple subnet boundary. If a mask you're working with doesn't convert cleanly here, that's often the reason — it may be a valid, intentional discontiguous wildcard mask rather than an error.