If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?
I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
TTL is Time To Live. Each hop decrements this field by one, and if the value reaches 0, the packet is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is an IP routing loop present. The sender of the packet can set the TTL to any value, up to 255.
Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.
PING localhost (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms 64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms
64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.