Hi Piotr,
the "best solution" will strongly depend on how often you've to contruct the $newaddr on a single TCP connection.
1.) Using the [scan] command to split an IP into octets will cost more cpu cycles than transforming the IP using the [IP::addr] command. So for a single transformation the [IP::addr] command should be used.
2.) Using a [scan] command once during CLIENT_ACCEPTED and then substitute different subnet variation and/or on multiple consecutive HTTP_REQUEST would be faster than calling [IP::addr] multiple times.
Cheers, Kai