Dynamic IP Addresses
A static IP address is intended to stay assigned to the same connection or system. A dynamic address is assigned for a period set by the network and may later go to a different connection or device. That period is often called a lease or address lifetime, and it may be renewed. This applies to private networks as well as Internet providers, and the address format does not reveal which kind it is.
Static addresses make services easier to reach consistently. Dynamic addresses let Internet Service Providers (ISPs), the companies supplying Internet access, reuse limited address space efficiently. For investigations, the important point is that an address observed yesterday may not identify the same customer, device, or location today.
How do static and dynamic IP addresses compare?
| Characteristic | Static IP address | Dynamic IP address |
|---|---|---|
| Assignment | Reserved for the same service, site, or customer connection. | Leased from a pool and available for reassignment. |
| Typical use | Servers, gateways, business links, and allowlisted systems. | Residential broadband, mobile access, and ordinary devices. |
| What changes | Usually stays stable until the service or contract changes. | Can change after reconnects, lease changes, moves, or pool rebalancing. |
| Historical attribution | More stable, but still identifies a connection rather than a person. | Requires the provider's assignment records for the event time. |
A current IP lookup cannot reliably tell whether an address is contractually static or dynamically leased. Reverse DNS naming and long-term stability can provide clues, but the provider's allocation system is authoritative.
Common static and dynamic IP questions
How can I tell if my IP address is static or dynamic?
An external lookup cannot prove your contract type. An address that stays unchanged for months may still be dynamically leased, and a static assignment can change when service is reconfigured. Check your ISP account or contract, or ask the ISP directly.
Static versus dynamic is separate from public versus private. A public or private address can be either static or dynamic. A static address behind CGNAT is still not a directly reachable public address.
Will restarting my router change my public IP?
It might, but a restart does not guarantee a new address. The provider can return the same lease, keep the assignment tied to your account or equipment, or place the connection behind the same shared gateway. Only the provider knows the assignment policy.
Do I need a static or dynamic IP address?
Dynamic service is enough for ordinary browsing, streaming, and applications that make outbound connections. A static public address or stable IPv6 prefix is useful when other systems must reliably connect to you, such as for a self-hosted service, site-to-site VPN, DNS record, or IP allowlist. Static does not automatically mean publicly reachable; firewall and NAT policy still matter.
Can I ask my ISP for a static IP address?
Yes, but availability and price depend on the provider and plan. Ask whether the offer is a dedicated public IPv4 address, a stable delegated IPv6 prefix, or only a fixed address inside the provider's network. Also ask about CGNAT, inbound connections, reverse DNS, and what events can change the assignment.
Why does a dynamic IP address change?
An ISP assigns an address when a customer, router, modem, phone, or gateway connects. The assignment can change when a lease expires, a router reconnects, equipment is replaced, a subscriber moves, a mobile device changes network attachment, or the provider rebalances address pools. Some leases remain stable for months; others change much sooner.
Reassignment can change the user behind the address without changing the public network facts. The registered network holder and announcing Autonomous System Number (ASN) stay at the provider level while the individual user behind one address changes.
What can change in IPv6?
IPv6 has two separate kinds of change. A host can create and rotate temporary IPv6 addresses inside an unchanged network prefix. Separately, a provider can renumber the delegated prefix itself. Seeing the device-specific part change does not prove that the customer's prefix changed, and a stable interface address does not prove that the provider delegation is permanent.
How are residential IP addresses reassigned?
Home internet connections receive an address through Dynamic Host Configuration Protocol (DHCP), Point-to-Point Protocol over Ethernet (PPPoE), or a provider-specific provisioning system. The address stays stable for weeks or months, or changes after a reconnect. Stability depends on the provider's network design and account policy, not on the address itself.
When a residential address returns to the provider's pool, it may later be assigned to a different household. Even when a lookup performed today shows the same ISP, city, reverse DNS style, or IP range, that does not prove the same subscriber used the address during an older event.
How are mobile IP addresses reassigned and shared?
Mobile networks add another layer of movement. For IPv4, carriers often aggregate many users behind shared public addresses, regional gateways, or Carrier-Grade NAT (CGNAT). Treat a shared public IPv4 source as carrier-gateway context rather than evidence of one device. A native IPv6 connection may instead use a globally scoped address from a prefix delegated to that subscriber or session, but the address alone still does not prove one device or person.
Mobile users move between cells, regions, access technologies, roaming partners, and gateway pools. Session changes, roaming, and gateway pooling can produce different public addresses. With shared IPv4, many customers can also appear behind the same public address at the same time with different source ports: numbers that help distinguish their exchanges of data at the shared address.
Why might yesterday's user differ from today's?
Dynamic reassignment creates a timing problem. Suppose an abuse event was logged from 203.0.113.24 at 2026-06-18T14:32:45Z. If you look up the address a day later, the lookup describes the address as it is known now, not necessarily who had it at the event time.
| Question | What can answer it |
|---|---|
| Who used it then? | The provider's historical assignment records are needed to answer that. |
| Who uses it now? | A current lookup describes the address's public network context, not the current customer or gateway session. |
| Where was it then? | Location data may describe a provider region or gateway and may lag reassignment. |
| Was it suspicious? | Bad activity by one past user should not automatically mark a later user as bad. |
Treat the IP address as a point on a timeline, not as a permanent identity. The closer your lookup, logs, and provider records are to the event time, the stronger the evidence becomes.
How do dynamic addresses affect investigations?
Dynamic addresses are still useful investigative signals. They identify the provider, approximate network, routing context, and sometimes a broad region. They should not be treated as proof of a person, device, home address, or current subscriber.
- Preserve the exact event time, source and destination IP addresses, their ports, and the protocol recorded by the Internet-facing system. These connection details are called a connection tuple. The protocol, such as TCP or UDP, defines how traffic is exchanged.
- Keep the original observed address, derived client IP, and immediate peer as separate fields.
- Use current lookup data carefully because assignments, location, and reverse DNS change.
- Combine network context with account, device, application, and provider records.
See Logging best practices for the complete evidence checklist.
What can IP Lens show about a dynamic address?
IP Lens can help you understand the public network context around an address: registered holder, routing, reverse DNS, approximate location, and tags. It cannot identify the subscriber that used a dynamic address at a specific time; that usually requires the provider's assignment records. A content delivery network (CDN) serves content through distributed servers, and a reverse proxy receives requests on your application's behalf. If your application sits behind either, first confirm the real client IP.
Dynamic reassignment is also one reason IP location disagrees between sources or changes over time.