5

If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

1

4 Answers 4

4

TTL is Time To Live. Each hop decrements this field by one, and if the value reaches 0, the packet is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is an IP routing loop present. The sender of the packet can set the TTL to any value, up to 255.

1

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms
0

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

0

if you research you will know that ttl=64 is basically tel's the which operating system server is using in your case it uses Linux based server ttl=128 windows os

1
  • 1
    Linux and Windows could use the same default value, I think they differ by chance. A particular machine can be configured to use another value. When the packet travels, its TTL decreases. While in many cases one can take a reasonable guess on the OS of the server, it's not the meaning of TTL. Jun 17, 2021 at 6:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy