A traffic distribution method that sends requests from the same client IP address to the same backend server. In network and application delivery, the load balancer calculates a hash from the source IP to preserve session affinity, which can improve stateful connection handling but may create uneven load when many users share one IP.
How IP Hash Load Balancing Works
IP hash load balancing uses a deterministic hash of the source IP address to choose a backend server. That keeps repeated requests from the same client on the same node, which is useful when the application stores session state locally or when connection continuity matters more than perfect evenness.
The main trade-off is predictability versus balance. Because the same input produces the same routing choice, the method is easy to reason about and often stable during a session, but it can concentrate traffic when many users appear behind a shared address, such as a corporate proxy, NAT gateway, or mobile carrier egress.
Why It Is Used
Operators choose IP hash when preserving session affinity is more important than distributing every request evenly. It is common in application delivery designs where a backend keeps login state, shopping state, or other request-specific context that would be awkward to replicate across nodes.
It can also reduce the need for external session stores in simpler deployments. That convenience comes with an architectural cost, because the load balancer is now using client network identity as the routing key, which is a blunt signal and can change with network path changes rather than application needs.
Operational Limits and Failure Modes
IP hash can become uneven very quickly when large groups of users share the same public IP address. In those environments, the load balancer may pin a disproportionate number of sessions to one backend while other servers sit underused, which weakens capacity planning and increases the chance of hot spots.
It is also sensitive to address churn. If a client’s source IP changes mid-session, the request may be routed to a different backend and the application may appear to “lose” state unless the session data is shared or replicated elsewhere.
When to Prefer Another Approach
Use IP hash when session stickiness is a design requirement and the backend tier can tolerate imperfect balancing. If traffic is highly shared, mobile, or proxy-heavy, a cookie-based affinity method or a shared session architecture is often a better fit because it tracks the application session more directly than the network source address.
For modern distributed services, it is usually worth testing whether the application can become stateless instead. When state is externalized, the load balancer can make routing decisions based on capacity and health rather than client IP patterns, which usually produces better resilience and more predictable scaling.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Authentication and Authorization | Session affinity and backend routing affect how access continuity is preserved across requests. |
| Recommendation — Validate that routing-dependent sessions still enforce consistent authentication and authorization decisions. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Load balancers sit at trust boundaries and shape how inbound traffic is segmented and directed. |
| Recommendation — Place boundary controls at the load balancer and monitor traffic patterns for imbalance or abnormal routing. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Load balancing is an operational network infrastructure control that must be configured and monitored. |
| Recommendation — Review load balancer configuration, capacity, and health checks to avoid uneven backend utilization. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org