Tech Stuff - Static and Dynamic IP addresses

This FAQ discusses when you need may Static (or fixed) IP addresses (and how many) and when you can use Dynamic IP addresses. IP addresses may be either the familiar IPv4 style (192.168.2.1) or the newer IPv6 style (2001:db8:0:1::3f). IPv4 addresses are in increasingly short supply and most organizations charge for the use of Static IPv4 addresses - sometimes quite a lot. IPv6 addresses are becoming more common and are readily available - often in very large numbers and usually at significantly lower prices than IPv4 addresses. However, static IPv6 addresses may need access to various conversion/tunnelling services to interwork with the huge base of IPv4 users so you need to carefully discuss their use with your ISP or Service Provider.

The answer as to whether you need Static or Dynamic IP Address(es) depends on at least a vague understanding of the role of DNS, local and global IP adresses and roughly what DSL or cable modems do. If you are comfortable with this stuff you can skip to the short answer. Otherwise, you may be advised to read this next part - and perhaps be advised to have headache medication on hand.

IP Address and URLs (Names): When you access a service (web, ftp, mail and so on) the client application (such as a web browser or a mail client) typically uses a name (more correctly a Uniform Resource Locator or URL for short). As an example, you access this page by typing (or clicking a link) which refers to the URL http://www.zytrax.com/isp/faqs/static.htm. The Internet, like all other networks, knows nothing about about names - it only knows about addresses. In the case of the Internet these are IPv4 or IPv6 addresses. So the start of the process to access, say this web site, is to translate from the URL to an IP address. In this case the www.zytrax.com part of the URL http://www.zytrax.com/isp/faqs/static.htm is translated (or resolved in the DNS jargon) by a Domain Name System (DNS) resolver, typically located at your ISP or Service Provider into its IPv4 (or IPv6) address. DNS data is normally static or changes very slowly (timescale may be measured in years) mostly for reasons of performance and service accessibility. If the IP address of your bank, or google, kept changing you might miss it due to latencies and caching (saved copies) - not terribly useful. See the section below on Dynamic DNS Providers under Alternative Approaches for exceptions to this general rule.

IP Address and Port Numbers: When a client (a web browser or email client) accesses a service (web, ftp, mail etc.) it sends a message which, among lots of other data, contains the client PC IP address and an arbitrary or random port number in the range 1024 to 65535 (this is the source address information - so that the receiving system, say the web server, knows where to return the answer or response) and the IP address and port number of the desired service (the destination address information). Services such as web, ftp, mail and so on use Well Known Port Numbers (defined in a list maintained by IANA). In the case of a web service this Well Known Port Number is 80, FTP uses port 21 (and port 20), mail uses port 25 (SMTP) for outgoing mail and either port 110 (POP3) or port 143 (IMAP) for incoming mail and so on. When the local PC (or server) is connected to the Internet using a Cable or DSL modem a lot of other stuff happens next.

Local and Global (Remote) IP Addresses: It gets a bit messier now. If you are connected to the Internet using a DSL or Cable modem then your local PC(s) has/have been allocated a local IP address (typically 192.168.x.x) by the modem using a protocol called Dynamic Host Control Protocol (DHCP). Local addresses of the form 192.168.x.x (there are specific groups of IP addresses allocated exclusively as local IP addresses) cannot be routed across the Internet - they are only usable on your local (domestic) network. To route traffic (messages) from your PC to the Internet the local address must be converted (or translated) to a global IP address (which can be routed across the Internet). This is done by another piece of software in your DSL or Cable modem called a Network Address Translator (NAT). The translation may be to a static or a dynamic IP address - it depends on what service you are paying your ISP or Service Provider for. In the vast majority of cases you will be using a dynamic IP address and, as described below, it will change from time to time based on the policy of your ISP or Service Provider.

Static and Dynamic IP Address Properties

As the name implies Static IP addresses are the same every time you connect or send a message. Static IP Addresses are used by all major web sites, email services, FTP services and so on. There are no exceptions to this. You will pay handsomely for static IP addresses. Dynamic IP addresses may change each time you connect to the Internet or even, in extreme cases, every time you send a message. Dynamic IP addresses are the normal customer access method used by most ISPs or Service Providers. When using dynamic IP addresses, even if you are permanently connected (always-on) some ISPs/Service Providers change dynamic IP addresses every 24 hours, others change less frequently (monthly or even longer in certain cases). Check your local ISP's policy on IP address change frequency. You will see no operational effect in normal user browsing or access when the IP address changes - but neither will you be able to stop the IP address change process.

Note: Even if, by observation, a dynamic IP address does not change frequently it still can at any time solely at the discretion of your ISP or Service Provider. For example, a change of network policy or installation of new equipment or because it's Tuesday. You do not control the IP address change policy, your ISP/Service Provider does.

Typical Flows

The following diagram shows a simplified data flow across a network. This diagram may, or may not, help to understand the traffic flows and who translates what, where. If this stuff gives you a headache - just skip it.

The typical traffic flows for a normal customer installation (with a DSL/Cable modem) are:

1. The Cable/DSL modem(3) while located on your premises is nominally controlled by your ISP/Service Provider - it supports their network architecture. You can control some of its configuration, in most cases not all.

2. When a PC (1) is switched on it communicates with the DSL/Cable modem (3) using a protocol called DHCP (A) to obtain certain critical information:

   • Its IP address: almost always this a private IP address in the range 192.168.x.x, though other ranges are possible. This IP addresses cannot be routed accross the Internet. It has to be converted into a Public IP address before this can happen.

   • Its DNS address: DNS is used to convert (look-up) a name (such as www.example.com) to its real IP address. Networks only use IP adresses for communication. Names are a convenience for we simple humans. Almost always, the DNS address points to the DSL/Cable modem (3). This box provides what is called a DNS Proxy service. The DNS proxy service knows about other DNS services (indicated by (B) and (4)) which it will use transparently when your PC requests a name, such as www.example.com.

   • Its external routing address: Internet routing (sending messages from one computer to another) uses what is called a next hop routing method. Your PC knows the first hop (location) of where to send messages (after the DNS name look-up is complete). This location (router) knows where to send it next, and so on until the message gets to its destination. The routing address is always the address of the DSL/Cable modem (3). Which means that (3) will receive every message sent out by your PC (and conversely receive every message sent to your PC).

3. If your PC (1) has loaded a browser (Internet Explorer, Chrome or Firefox) and you type www.example.com (or any other name) then the browser does a name to IP address lookup using its local DNS address - which is the DSL/Cable modem ((3) - see DHCP above for process) which in turn uses its DNS proxy function and its private information to access another DNS (4)(B) which in turm may access the wider DNS hierarchy (5). Eventually, your browser will get back the destination IP address. The browser will construct a message and sent it off to the local router (C).

4. The local router is always the DSL/Cable modem (3) (see DHCP above for process). At this point the DSL/Cable modem (3) will convert your local (private) IP address (known as the source IP address of the message) into a public (fully routable) IP address using a process called Network Address Translation (NAT) (D).

   Note for Purists: Increasingly today large ISPs may either delay this translation process, or even perform a second one, in what is typically called a NAT gateway (6). This does not impact the process it is simply a matter of ISP/Service Provider network architecture. In all cases an IP address translation will take place.

5. Using the next hop routing method the message (now including the translated Public IP address as the source IP address) will eventually arrive at the requested web site (2). The web site (2) will send a reply to the public IP address in the message (which now becomes the destination IP address of this reply message), which will finally arrive back at the DSL/Cable modem (3). The DSL/Cable now does a reverse translation (D) and sends the message back to your PC (1) with your private IP address as the (tanslated) destination IP address.

That's all there is to it.

When you do NOT need static IP addresses:

If you ONLY do things from the following list you do not need static IP addresses:

1. If you browse the Internet;

2. If you send and receive e-mail via an off site mail server or service (the normal method and typically using your ISP's mail server) or a typically web based mail service such as gmail, hotmail, yahoo mail and many others);

3. If you download or upload files (using ftp or http);

4. If you use Instant message services or chat services;

5. If you run any services, such as web or FTP servers, that ONLY require access from your local area network (single site) or perhaps within a multi-site corporate network, and that DO NOT require or ALLOW access from the Internet.

When you need Static IP Addresses:

You need one or more Static IP addresses if any of the following are true:

1. You run one or more Web server's directly on your site that require external access (from the Internet);

2. You run one or more E-mail server's directly on your site that require external access (from the Internet);

3. You run one or more FTP server's directly on your site that require external access (from the Internet);

4. You run one or more DNS server's directly on your site that require external access (from the Internet);

5. You run any other service or 'Application' that requires external access (from the Internet). Some Financial Terminal Client and other licensed applications require that you have a static IP address for licensing purposes;

6. You require or allow 'incoming' Video or Audio services. In this case you may need to use static IP addresses. As an example, if you run an on-site IP-PBX you will typically need one or more static IP address(es). However, in some cases audio and/or video client applications (including some IP-PBXs) will require you to connect, or register, with an external server which will forward incoming traffic. When using these types of clients/applications you may not need a static IP address. Verify the details with the client/application supplier.

Note: If you are using DSL/Cable to host local services, be aware that these services normally provide asymmetric speeds and that incoming speed (from the Internet) is normally faster than the outgoing (to the Internet) speed. In some cases this difference in speed is significant. In the case of browsing and most client services this difference works in your favor. You send a small amount of data (a single URL) at, relatively, slow speed and get back a lot of data from a web site or FTP server - a file download or a web page - at a,relatively, fast speed. If you are providing a service using DSL or Cable the opposite is true. Users send you (incoming) a small amount of data (a single URL) at a, relatively, fast speed and your local service sends (outgoing) a lot of data at a, relatively, slow speed. Check with your ISP/Telecom supplier for the details.

How many IP Addresses do you need?

Use the following rules of thumb to calculate the number of required IP addresses.

1. If you run one of any type of server (FTP, Web, E-mail etc.) on site then you only require a single Static IP address. Each service uses a different well known port number, for instance web/http uses port 80, and most DSL and cable modems embed a port mapper (a.k.a NAT-PAT);

2. If you run one copy of any application which uses Fixed (or well known) Port Numbers you only need a single Static IP address;

3. In all other cases you need as many Static IP addresses as there are Applications or Servers that use the same Port Number.

If you have any doubts discuss them with your ISP's technical specialists.

Security Implications

This section briefly discusses the security implication involved with using static or dynamic addresses.

By definition, once a static IP address is allocated it does not change. Once an address is acquired by 'the Bad Guys' it is permanently open to attack. Appropriate network defenses must be constantly available to migigate any such attacks. Theoretically, the same is not true of dynamic IP addresses since the IP address changes it is not permanently open to attack. However, many modern attacks occur as a result of visiting, say, a rogue web site. At the time the connection to this web site is made the dynamic IP address, is for all practical purposes, static (it may, subsequently, change in 2 minutes time or 2 days time, or even 2 seconds time) and immediate attacks can be launched in the same way as for static IPs. In short, network/OS defenses in all cases are important. The risks are, in general, slightly lower over time for dynamic IP addresses but the immediate threat is essentially the same. Keep those firewalls configured and your PC's software up to date - always no matter what type of address you have.

Alternative Approaches

External Hosting

Hosting services range in price from less than $10 per month to many $100's of dollars. You get what you pay for in terms of reliability, software supported, permitted access, volume of data allowed, bandwidth, and so on - but do lots of homework before you choose. Increasingly, external hosting is being provided using virtualized services which typically allows very high levels of user control over the hosted service since, in effect, you may be the sole user of the virtual host (even though the physical host is shared by 10s or even 100s of virtual hosts).

Dynamic DNS Services

All externally visible (global) IP addresses are forward-mapped (from name to IP) and in some cases reverse-mapped (from IP to name) via a DNS service. Thus, if someone types www.example.com into their web browser it is translated via a DNS service to a specific IP address using a forward map. In most cases the IP address in the DNS is a static IP address. However, there are a number of organizations (Dynamic DNS providers) that will map names, such as www.example.com or mail.example.com to a dynamic IP address by constantly monitoring your Dynamic IP address and changing the addresses in the DNS whenever your IP address changes. While this can be very effective in terms of cost savings there will always be a time lag (will vary with the Dynamic DNS provider) between the Dynamic IP address change and when it is recognized by the Dynamic DNS Service which can interrupt external user access. This may not be problematic for many uses but in time sensitive services it may be catastrophic. In such cases it may be better to host the service externally rather than try and map it to a dynamic IP address.

---

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.