Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

share|improve this question

migrated from Feb 2 '10 at 22:40

This question came from our site for professional and enthusiast programmers.


TTL is Time To Live. Each hop decrements this field by one, and if it reaches 0 it is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is a IP routing loop present. The sender of the packet can set the TTL to whatever value it wants up to 255.

share|improve this answer

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

share|improve this answer

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost ( 56 data bytes
64 bytes from icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from icmp_seq=2 ttl=64 time=0.139 ms
share|improve this answer

You must log in to answer this question.