This presupposes a solid knowledge of binary and IP Addressing conventions.

Rule 1
Remember that the first octet only ever designates the class of IP.  (ie. Class A, Class B or Class C)

Rule 2
The first octet that contains a zero bit, is always the octet where the action occurs.

255.255.255.0 — Calculation happens in 4th octet
255.255.0.0 — Calculation happens in 3rd octet
255.255.248.0 — Calculation happens in 3rd octet

Rule 3 (See Rule #1)
The first octet always tells you the class of address no matter the octet where subnetting occurs.
Subnetting calculation always happens in the octet of the IP Address that the subnet mask designates with its first instance of less than 255, or more simply, the first instance of a zero bit.

Therefore, given 172.16.10.10 with a subnet mask of 255.255.248.0, we know that the calculation will happen in the IP’s 3rd octet. The mask designates that with 248. It is imperative that this is understood. Another way of looking at it in the above example is; the octet in the subnet mask with the first instance of less than 255, or the first zero bit, is the multiplier.

Rule 4
When the multiplier (first zero bit octet or octet with first instance of less than 255) is determined always subtract it from 256 to determine the ranges.
ie. 256-248=8, hence 8 is the multiplier.

Using 172.16.10.10 with a subnet mask of 255.255.248.0, it is determined that we have a Class B address using 172, our calculation must happen in the 3rd octet, and we must subtract 256 from 248 to get 8.

The rest is academic:

The multiplier has determined our first subnet range 8 – 16 – 24 – 32 – 40, etc

The first range (excepting the use of subnet zero) begins with 8 and ends with 15, the second range begins with 16 and ends with 31, next range begins with 32, and so on up to 255.

Important: There are 256 numbers total comprising the range 0-255, including the zero.

In the IP 172.16.10.10/21 (notice the use of bit count; this equals 248 as well), to determine the number to subtract from 256 in bit count form, you need to add the bits…
1st octet 8 bits, second octet 8 bits, third octet 5 bits, hence
8 + 8 + 5 =/21 or 248 || or || 172.16.10.10 /21 = 172.16.10.10 255.255.248.0

Our calculation takes place in the octet designated by the first instance of a zero, or in our example, /21 or 255.255.248.0. we determine that 10 is the number occupying the third octet in our example, and our multiplier has determined the first possible subnet is 8 (excepting subnet zero) So, since 10 falls between 8 and 15 (16 begins the next subnet or network), our valid range for the address has been determined.
8 16 32…
9 17
14 30
15 31

So our 3rd Octet, which is 10 in the example, can only fall between the range of 8 (the network), 9 (our first valid host), 14 (our last valid host), and 15 which is the broadcast address for the network our number 10 resides in.

If we changed our third octet number to 172.16.20.10/21 or 255.255.248.0, we know that our calculation still takes place in the 3rd octet, but the number 20 falls between the network 16, the broadcast 31, and within the valid range of hosts which is 17-30…

Another example:

192.168.100.100 255.255.255.192

This is a Class C address.
The action takes place in octet 4

Subtract 192 from 256 which equals 64 and we can determine the network, the broadcast and the valid range of hosts because 64 is our multiplier hence:
64 128 192
65 129 193
126 190 254
127 191 255

Our number in the 4th octet is 100, our number 100 falls between 64 (the first network) and 128 (the second network). the subnet address is 192.168.100.64
The first valid host is 192.168.100.65
The last valid host in the range is 192.168.100.126
And the broadcast address is 192.168.100.127

It takes a little time and effort, and a lot of practice, but you’ll eventually be able to do it without paper.