5

If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

Improve this question
1

4 Answers 4

Reset to default
4

TTL is Time To Live. Each hop decrements this field by one, and if the value reaches 0, the packet is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is an IP routing loop present. The sender of the packet can set the TTL to any value, up to 255.

Improve this answer
1

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms
Improve this answer
0

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

Improve this answer
0

if you research you will know that ttl=64 is basically tel's the which operating system server is using in your case it uses Linux based server ttl=128 windows os

Improve this answer
1
  • 1
    Linux and Windows could use the same default value, I think they differ by chance. A particular machine can be configured to use another value. When the packet travels, its TTL decreases. While in many cases one can take a reasonable guess on the OS of the server, it's not the meaning of TTL.
    – Kamil Maciorowski
    Jun 17, 2021 at 6:48

You must log in to answer this question.