0

Im just looking for help with a question on Wireshark.

If the TTL value of a DNS query is always 128 why is the response TTL not 128?

Will the DNS Query TTL always be 128 by default and the response variable or is it just the capture im running with Wireshark?

Improve this question
1
  • 6
    The response packet will presumably have come through several hops, each of which decrements the TTL.
    – MadHatter
    Dec 5, 2013 at 20:22

1 Answer 1

Reset to default
3

As MadHatter noted, that is normal behavior. Any time a packet makes a hop (crosses a router or gateway), TTL is reduced by 1.

This is used to prevent packets from circulating a network indefinitely - if the TTL reaches zero the packet will be discarded.

In your example, when you send your initial DNS query the packet has a starting TTL of 128. When you receive the response, TTL on the packet has been reduced by the number of hops between you and the DNS server you queried.

Improve this answer

You must log in to answer this question.