[vox-tech] Search Warrant Question re: IP Address Leases

[Shwaine]

On Fri, 7 Jan 2011, Bob Scofield wrote:

> When I Google about IP address leases I'm reading about five and eight day
> leases.  But here is the information supplied by Comcast (IP address redacted
> by me):
>
> IP_Address	  Lease_Grant (UTC)	               Lease_Expire (UTC)
> xx.xxx.x.xxx     2010-08-23 02:56:44.0          2010-09-28 22:04:00.0
> xx.xxx.x.xxx     2010-04-08 06:28:58.0          2010-08-23 02:52:53.0
>
> I read this as saying that the defendant had the same IP address for about six
> months.  In fact the defendant may have had the same IP address for even
> longer as Comcast did not retain any records before April 8, 2010.
>
> So it seems to me that this dynamic IP address is like a static address.  Is
> this unusual?  Is the information provided by Comcast plausible?  Why would a
> lease be given for such a long period of time?  To track down people
> violating the law?
>

As people pointed out, this is pretty common with several providers. I've 
never had a machine get a new IP address at lease renewal with my current 
cable provider (a Time Warner spinoff). The only time I get a new IP 
address is if the machine has been turned off for a while or when udev 
decides to ignore (and overwrite) 70-persistant-net.rules (losing the old 
lease file in the process).

Think of a lease as more like a license to temporarily use an IP address. 
When the lease is up, the machine can ask to "renew" its license to use 
the IP address. If the provider honors this request, the machine can renew 
the same IP address pretty much as long as it wants to (or until the ISP 
stops honoring the request). There are a few ISPs which completely ignore 
this request and just hand out a new IP address at the end of each lease, 
but most will honor it as long as the IP is still valid and available.