This information is on page 8 of the "AppleTalk Phase 2 Protocol
Specification":
Obtaining a provisional address
Obtaining a provisional address upon startup is accomplished in two different
ways depending on whether the node has previously saved an address in parameter
RAM. An address saved in PRAM consists of two parts: the 16-bit network
number, denoted $nnnn, and the 8-bit node ID, denote $yy. The concatenated
24-bit address value of [network number, node ID] is denoted $nnnnyy.
If no address was previously saved in PRAM:
Upon starting up when no information is saved in parameter RAM, a node will
randomly select a provisional network number $FFnn in the startup range. This
range is specified to be $FF00 to $FFFE inclusive (most significant byte
first). The node then also randomly selects a node ID $yy (yy cannot be $00,
$FE, $FF). As in AppleTalk Phase 1, the node must first use AARP to ensure
that $FFnnyy is not in use by any other node on the network. If another node
is already using this address, the node should try all other possibilities for
$FFnnyy until a valid provisional address is obtained.
If an address was saved in PRAM:
If there is a saved 24-bit address of the form $nnnnyy in PRAM, the node can
use it as the provisional address. The node must use AARP to ensure that this
address is not in use by any other node. If another node is already using this
address, the node should try all other possibilities for yy (yy cannot be $00,
$FE, $FF) keeping nnnn the same until all possibilities are exhausted (nnnn is
probably a valid network number for this network unless the node has been moved
from another network).
If all possibilities are exhausted, the node must select a new address as if
none was previously saved in PRAM (as described in the previous section).