I'd take IP out of it. Having the node ID, the session ID could only be a certain number of things that would hash properly from a valid IP. This would give a motivated person a fair chance at getting a network and possibly a geographic fix on a person. That's not very anonymous. The session and the node ID should be enough, as the session ID should be unique.