Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

share|improve this question

migrated from stackoverflow.com Feb 2 '10 at 22:40

This question came from our site for professional and enthusiast programmers.

    

3 Answers 3

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms
share|improve this answer

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

share|improve this answer

TTL is Time To Live. Each hop decrements this field by one, and if it reaches 0 it is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is a IP routing loop present. The sender of the packet can set the TTL to whatever value it wants up to 255.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.