When using Tor bundle the exit ip changes as it should. While running wireshark I noticed that Tor almost always seems to use the same entry node/server (located in Germany). Is this normal for Tor? Always thought that all nodes where changed.
Try reading about tor entry guards and why it is actually safer this way, especially if you are using hidden services. Not saying you are, just saying. If casual use based on wanted privacy is your "mode", then you could do something very easy. Just keep a clean unused template of TBB (currently 4.0) on your desktop. Periodically blow away the TBB you used and make a quick copy of the template. The template will never have seen the internet so the pasted clone will set up a brand new circuit including relay 1. You can accomplish this task in 30 seconds every day if you wanted to.
As of the last release, the Tor client now sticks with just one entry guard, for several months. It also picks backup entry guards, in case the main one is unavailable. Developers did that to reduce vulnerability to attacks using malicious relays.