title: Analysis of the structure of Oracle SYS_GUID()
body: <p>I've got some data containing 14,800 GUIDs, which were generated by a third-party in an Oracle database using SYS_GUID(). The GUIDs only vary by a few bytes at positions 7-12, which appear to be some kind of counter.</p>
  
  <p>Example, with formatting to isolate the counter part</p>
  
  <pre><code>FC82E8-BAC381-7272E0438DC611AC3F8D
  FC82E8-BAC382-7272E0438DC611AC3F8D
  FC82E8-BAC383-7272E0438DC611AC3F8D
  FC82E8-BAC384-7272E0438DC611AC3F8D
  FC82E8-BAC385-7272E0438DC611AC3F8D
  FC82E8-BAC386-7272E0438DC611AC3F8D
  FC82E8-BAC387-7272E0438DC611AC3F8D
  FC82E8-BAC388-7272E0438DC611AC3F8D
  FC82E8-BAC389-7272E0438DC611AC3F8D
  FC82E8-BAC38A-7272E0438DC611AC3F8D
  </code></pre>
  
  <p>There are only a few unique beginnings</p>
  
  <pre><code>["0D3EDF","18257D","1827AE","1827BF","1828E0","182C62","182C7D","1839A0","183A31","183BEE","183E6D","183FA4","184012","1AD4F9","1AD59B","1AD59F","1AD70A","1AD731","1AE5A9","1AE5AD","1B4F17","1B615F","1B7814","1B8793","1B8C6A","1B8C8C","1B9B5C","1B9B8A","1BDA52","1BDA60","1BDA70","1BEB88","1BEC7D","1C7AD1","1C8E26","1C8E4E","1C8E8E","1C8FA6","1E0C80","1E32D3","2052E1","2052E7","2052EC","21FC74","233BC2","233C06","24E2C7","288030","2938B8","CFB613","D25095","D46CB5","D48475","DD5190","ECB728","F1CED9","FC82E8"]
  </code></pre>
  
  <p>and only a few unique endings</p>
  
  <pre><code>["02CBE053802011AC2597","04CFE053802011AC2355","062EE053812011AC598F","0656E0438DC611AC34B2","07A5E053802011AC3DBC","0894E0536A2011AC73AB","0930E053802011ACD547","0B1BE053692011ACF2E0","0EA9E053802011AC44C8","0ECAE053812011ACF695","0F83E053692011AC3C24","111DE053812011AC1AAB","14C9E053802011AC49D3","16DCE0438DC611AC6AA4","1976E0536A2011AC9642","19E0E0536A2011AC637D","1A7EE053802011ACD813","1D58E0536A2011AC6A99","2045E053802011AC386E","20B2E053692011ACABF8","2A68E053692011AC4A9F","2BA5E053812011AC0D9A","2DDDE053802011AC0D83","2FA9E0433CC411AC9094","2FAFE053812011ACB024","306DE053802011ACBA9C","3225E053802011AC6040","3254E0433CC411ACFD01","32B8E053812011AC69A4","32F0E053692011ACC2A9","3466E0536A2011AC5567","35A1E053812011ACA6C9","3687E053692011AC9DB1","38C7E0536A2011AC679B","39E8E053692011ACC84F","39EAE053692011ACEC25","3A31E053692011AC5D6E","3E9FE0536A2011AC5C60","3EEEE053812011AC0564","44A6E053802011AC7839","4623E053802011ACCB8A","481AE053812011AC9FC9","4919E0433CC411ACF60C","49B9E0536A2011ACD453","4D02E053812011AC92B6","4DF7E053692011AC7BB1","4EB5E053812011AC125C","5092E053692011ACED10","5907E053802011AC163F","62C7E053812011ACBCE9","6307E0536A2011AC0EC2","6322E053812011AC153B","63B1E053812011ACF40B","64ADE0536A2011ACD703","65BDE053802011AC2514","66B8E053692011AC7118","673AE053802011AC094D","694EE0433CC411AC73CC","6CECE053802011ACB8A4","7272E0438DC611AC3F8D","741AE0536A2011AC67D2","75C3E053812011AC5BD3","7952E0433CC411ACA994","79A9E053692011AC295F","7BB9E0533CC711AC4D20","7D39E0536A2011ACE93C","7D9CE053692011AC993C"]
  </code></pre>
  
  <p>I can't find any documentation on SYS_GUID other than <a href="https://docs.oracle.com/cd/B12037_01/server.101/b10759/functions153.htm" rel="nofollow">official documentation</a> that states </p>
  
  <blockquote>
    <p>On most platforms, the generated identifier consists of a host
    identifier, a process or thread identifier of the process or thread
    invoking the function, and a nonrepeating value (sequence of bytes)
    for that process or thread.</p>
  </blockquote>
  
  <p>I've tried searching for the source code and some analysis - including converting to strings, reversing, converting to decimal etc, to see if any recognisable IP schemes etc.</p>
  
  <p>I'd really like to know which bytes are the host, in what form - e.g. MAC/IP, which are thread and process etc, any use of hashing MD5/SHA etc. I completely understand this is a highly specific implementation detail that might have varied between Oracle releases, but I'm interested none the less.</p>