Guide
Plan IPv4 and IPv6 subnets
A prefix length is a boundary. Plan from exact ranges, not from the way an address happens to be written.
Turn a prefix into a range
In CIDR notation, the number after the slash counts fixed network bits. An IPv4 /24 fixes 24 of 32 bits, leaving 8 bits and 256 addresses. An IPv6 /64 fixes 64 of 128 bits. A typed address can contain host bits; the canonical network is the value after those bits are cleared. Before allocating or aggregating, normalize every block and calculate its first and last address. Display compression in IPv6 does not change the underlying 128-bit range.
Allocate different sizes without overlap
Variable-length subnet masks let a large network contain differently sized child blocks. For a documentation-only example, 192.0.2.0/26 occupies addresses .0 through .63, and 192.0.2.64/27 occupies .64 through .95. A /27 cannot start at .63: its start must align to a 32-address boundary. Allocate the largest needs first, then reserve space for growth. Run a containment or overlap check on the final list rather than assuming that different labels imply disjoint ranges.
IPv4 host counts need context. Ordinary subnet conventions reserve the network and broadcast addresses, but a /31 on a point-to-point link can use both addresses under RFC 3021, and a /32 identifies one address. IPv6 has no broadcast address; do not copy the IPv4 subtraction rule into IPv6 counts.
Aggregate only contiguous siblings
Two adjacent blocks of the same length combine into a shorter prefix only when they are aligned siblings. Aggregating unrelated blocks can accidentally include addresses you do not control. Routing uses longest-prefix matching, so a narrower route can still override a broad aggregate. For IPv6, a /64 is conventional for stateless autoconfiguration, but forwarding mechanisms can process any valid prefix length through /128. Keep interface-addressing requirements separate from route aggregation.
Subnet calculator shows canonical ranges and host rules. CIDR tools can split, aggregate, exclude and compare blocks exactly in both address families. These computations run locally; they do not assert that a route is announced or reachable.