How can I understand if an IP address is dynamic or static?

Question

I have an IP list and I have to seperate them as static ones and dynamic ones. Is there any tool or way to do that? Thank for any advice...

IPs on a company LAN, or IPs showing up in a log of an internet facing server? — rackandboneman, May 17 '12 at 14:08

score 12 · Accepted Answer · answered May 17 '12 at 14:07

12

tl;dr - Nope.

The difference between static addresses and dynamic ones is merely that dynamic addresses are handed out by a DHCP server. Period. The range of IP addresses that a DHCP server can hand out is completely arbitrary, so without access to the DHCP server's configuration, there's no way to tell definitively which is which.

Depending on what lease duration the DHCP server is configured with, you may be able to infer information about certain IP by seeing if their ARP mapping changes over time.

If you're talking about public IPs, you may be able to do a reverse dns lookup on the IP, and if a PTR record exists for it, the hostname returned may give you some information about whether it's a static or dynamic address.

To reiterate, though, with the IP alone, there's no way to get the information you're looking for.

answered May 17 '12 at 14:07

EEAA

108,414
18
172
242

I would consider AutoIP to be "dynamic" too. ;) – Chris S May 17 '12 at 14:11
Heh, good point. – EEAA May 17 '12 at 14:11
You can hand out static reservations via DHCP as well. – Thomas G May 17 '12 at 15:05
@ThomasG - Yes, but those would still be considered as dynamic, since they are not set manually on the client. – EEAA May 17 '12 at 15:07
@ErikA Dynamic as far as the protocols involved but sold as "static" by the service provider as a non-changing address for a customer's CPE. It all depends on who picks the words. – Thomas G May 17 '12 at 16:17
There's no intrinsic difference as people suggest, however Look into good Anti-Spam lists. Many of them have a pretty good database of internet subnets which ISP's hand out as dynamic or reserve as static. They are simply accumulated data on ISP's IP usage, but they can be fairly accurate. – Philip Couling May 17 '12 at 18:08

score 2 · Answer 2 · answered May 17 '12 at 14:17

There isa good chance to do a reverse ptr naming analysis and check for a dynamic / dial in name pattern there. THis should help for internet. http://www.debouncer.com/reverse-dns-check has a short mention of that - most providers use recognizable naming standards for dynamic ip addresses. http://www.linuxmagic.com/best_practices/check_dynamic_reverse_dns.html. It is prtty informal but you can check for patterns (dynamic, dial-in) or strings that show part of the ip address in reverse dns (i.e. 8-9-0-2.ip.someexample.com for the ip 8.9.0.2 is an indication this is from at least a pool allocated for semi dynamic allocation.

If that is not the case - or it is a LAN where the reverse entry is set to the machine name.... no way.

IT alway has error margings (example above the IP may be from a dynamic pool, but the DHCP may statically assign it via reservation).

At the end it is not the IP address that is dynamic. THis is like asking whether you can get the gender of a contract holder for a phone by looking at the phone number. Dynamic IP Addresss are not different - only managed by a computer.

score 1 · Answer 3 · answered May 17 '12 at 14:22

Generally - you cannot do this. But if you need to set up some security settings for your service (e.g. disable mail sourced from dynamic IP) - you can use dns-list dul.dnsbl.sorbs.net for reverse-check ip If sorbs return nxdomain on request for IP.AD.DR.ES (ES.DR.AD.IP.dul.dnsbl.sorbs.net) - it means that ip address is not listed as dynamic.

How can I understand if an IP address is dynamic or static?

3 Answers3