How even is the distribution of digits in the last part of an IPv4 address?

IPv4 addresses are not quite so clumsy and random as you would assume.

Firstly, an IPv4 address is separated into 4 octets, each ranging from 0 to 255. However, this is not entirely the case as 0 is a reserved number for the network and 255 is reserved for broadcast, which really limits you to 1-254.

Secondly, you have to consider that IPv4 addresses are assigned in blocks to organizations and ISPs who then subdivide them based on a subnet address that delineates which bits in the octet represent the network and which bits represent the individual host. So:

Network: 11.12.0.0
CIDR: 11.12.0.0/16
Subnet: 255.255.0.0
Hosts provided: 65534

Would mean you could have addresses ranging from 11.12.0.1 to 11.12.255.254. Because of this:

Three separate hosts, same network, but same last octet:
11.12.10.20
11.12.20.20
11.12.30.20

This means you can't always count on the last octet to be 'random'.

Thirdly, the means of IP address assignment is not always random. Most home users will get a public IP address assigned by their ISP via DHCP, where their endpoint will get an address picked by a computer (usually sequentially, first come/first served from an available pool) upon which they hold a lease for a predetermined amount of time (usually a couple days) before they are assigned another number. Large organizations (businesses, government) will often have a set of addresses that they always come from and these addresses are static and will not change.

To answer your question, given the above information:

1) IP addresses are not assigned at random. There is usually some sort of logical method for assigning IP addressed to allow for correct and timely routing of traffic across a network and the internet.

2) The distribution of the last octet of an IPv4 address depends upon a number of factors relating to the above information (and the mood of the network administrator, in some cases) and, therefore, not equal. You can not rely on only the last octet to provide 'uniqueness'.

Come on IPv6!


The last octet is likely to be skewed towards the lower end, because networks tend to be numbered from the bottom. A better scheme would be to treat the entire IP address as a 32bit unsigned integer and use the modulo operation to get the remainder when diving by the number of buckets you want. This would assign each subsequent (numerically) address to a different bucket (wrapping around when the last bucket is reached).

For example:

1.2.3.4 = 16909060
16909060 % 3 = 1

So this would put 1.2.3.4 into bucket 1 (where buckets are numbered 0, 1, and 2). 1.2.3.5 would go into bucket 2, and 1.2.3.6 would go into bucket 0.