If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?
I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.
feedback
|
migrated from stackoverflow.com Feb 2 '10 at 22:40
This question came from our site for professional and enthusiast programmers.
|
TTL is Time To Live. Each hop decrements this field by one, and if it reaches 0 it is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is a IP routing loop present. The sender of the packet can set the TTL to whatever value it wants up to 255. | |||
|
feedback
|
|
64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol. | |||
|
feedback
|
|
Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e. PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms | |||
|
feedback
|
