Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

share|improve this question

migrated from stackoverflow.com Feb 2 '10 at 22:40

This question came from our site for professional and enthusiast programmers.

    

3 Answers 3

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

share|improve this answer

TTL is Time To Live. Each hop decrements this field by one, and if it reaches 0 it is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is a IP routing loop present. The sender of the packet can set the TTL to whatever value it wants up to 255.

share|improve this answer

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.