What is the difference between a static and dynamic IP address?¶
A static IP address is intended to stay with the same customer, connection or service. A dynamic IP address is allocated from a provider’s pool and may change over time.
For an investigation, the practical difference is simple: a dynamic address must be matched to the right customer at the time of the event.
Static IP addresses¶
Static addresses are often used by businesses, organisations and internet-facing services that need a predictable address.
Static does not mean permanent. The address can still change if the customer changes service, the provider reorganises its network or the allocation ends.
A static address may give you a consistent link to a connection or service. It could represent:
- a business network used by many people;
- a server or hosted service;
- a firewall or VPN gateway; or
- a residential connection.
Dynamic IP addresses¶
Dynamic addresses are allocated from a pool controlled by the provider. An address might stay with one connection for months or change when the connection restarts, a lease expires or the provider changes its network arrangements.
You cannot normally tell whether an address is static or dynamic just by looking at it. An ordinary IP lookup may identify the provider, but it will not usually show which customer held the address or how it was allocated.
What to do with a dynamic address¶
Record and supply:
- the complete IP address;
- the exact date and time;
- the time zone or UTC offset; and
- the event or record the address came from.
The useful question is:
Which customer connection was using this address at this time?
The current user of the address may be different from the user at the time of the event. The provider’s historic allocation records are what matter.
When an address is shared¶
Carrier-Grade NAT (CGNAT) allows several customers to share one public IP address at the same time. In that situation, the provider may also need the public source port and protocol to identify the relevant connection.
Why can’t a provider identify one customer from some public IP addresses? explains what changes when the address is shared.
The point to remember
Dynamic addresses make accurate timing essential. Static addresses can provide continuity. In both cases, match the address to the relevant connection and event.
