Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

TTL value in PING response

Can someone explain to me in details on what basis the TTL value is displayed when we ping a remote host.

I am pinging a remote host from my WindowsXP system. Sometimes the TTL value is less than 127 and some times its close to 255. Both the resources are on internet.

13 REPLIES

Re: TTL value in PING response

hi,

In my knowledge the TTL value is the number of hops the packet takes along the path till destination.The number of hops is equal to the number of L3 devices through which the packet has traversed.Each time the packet arrives @ L3 device it processes it and forwards with decreaseD TTL value.

The different numbers in your case may be because the packet must be travelling from different paths.

HTH,

regards,

shri :)

New Member

Re: TTL value in PING response

I am pinging resource X which is 26 hops away and resource Y which is 16 hops away from my system.

C:\>ping x.x.x.x

Pinging x [x.x.x.x] with 32 bytes of data:

Reply from x.x.x.x: bytes=32 time=289ms TTL=236

C:\>ping y.y.y.y

Pinging y [y.y.y.y] with 32 bytes of data:

Reply from y.y.y.y: bytes=32 time=19ms TTL=112

On what basis the upper TTL value is taken? Why the TTL value is 236 when I ping X and TTL value is 112 in case of Y?

Hall of Fame Super Blue

Re: TTL value in PING response

Hi

Is y a windows machine and x a non-windows machine ?

Windows machines use a TTL beginning at 127 whereas unix/cisco devices use a TTL starting at 255.

HTH

Jon

New Member

Re: TTL value in PING response

My source machine is Windows XP, I do not know about X and Y.

Hall of Fame Super Blue

Re: TTL value in PING response

Source machine doesn't really matter, it's what the destination machine uses as it's TTL when it generates the ICMP echo response.

Jon

Silver

Re: TTL value in PING response

Hi Jon

"Windows machines use a TTL beginning at 127 whereas unix/cisco devices use a TTL starting at 255. "

That is a useful nugget of information which was previously unknown to me which I though merited a rating.

Best Regards & Many Thanks,

Michael

Hall of Fame Super Blue

Re: TTL value in PING response

Michael

Many thanks for that, nice to be appreciated :)

Jon

Re: TTL value in PING response

Hi Jon,

I just want to add to your very valuable information, as you said the TTL is all about the destination and has nothing to do with the source, different OS has different TTL (considered as an aspect of the OS fingerprinting):

Windows: 128

Linux: 64

Cisco: 255

Solaris: 255

below are ping results from the LAN to an example of all those from the same source:

Reply from 10.10.99.2: bytes=32 time<1ms TTL=128

Reply from 10.10.99.2: bytes=32 time<1ms TTL=128

Reply from 10.10.99.2: bytes=32 time<1ms TTL=128

Reply from 10.10.99.2: bytes=32 time<1ms TTL=128

Reply from 10.10.99.166: bytes=32 time<1ms TTL=64

Reply from 10.10.99.166: bytes=32 time<1ms TTL=64

Reply from 10.10.99.166: bytes=32 time<1ms TTL=64

Reply from 10.10.99.166: bytes=32 time<1ms TTL=64

Reply from 10.10.99.1: bytes=32 time=1ms TTL=255

Reply from 10.10.99.1: bytes=32 time=1ms TTL=255

Reply from 10.10.99.1: bytes=32 time=1ms TTL=255

Reply from 10.10.99.1: bytes=32 time=1ms TTL=255

Reply from 10.10.99.13: bytes=32 time=1ms TTL=255

Reply from 10.10.99.13: bytes=32 time=1ms TTL=255

Reply from 10.10.99.13: bytes=32 time=1ms TTL=255

Reply from 10.10.99.13: bytes=32 time=1ms TTL=255

BR,

Mohammed Mahmoud.

Hall of Fame Super Blue

Re: TTL value in PING response

Hi Mohammed

Good to see you back in action.

Jon

Re: TTL value in PING response

Hi Jon,

I am very glade too. Hope you are fine. I've tried to reply on your email a couple of days ago, but i get "Delivery to the following recipients failed due to a permanent error" "Remote host said: 550 This system has been configured to reject your mail (B)".

BR,

Mohammed Mahmoud.

Hall of Fame Super Blue

Re: TTL value in PING response

Mohammed

Not sure what's happening with the e-mail. I have 2 e-mail addresses

jon.marshall@networkrail.co.uk

jon.j.marshall@networkrail.co.uk

Probably the first is the best one to try.

Jon

svo
New Member

Hi Mohammed,

Hi Mohammed,

it is very nice answer. Can you explain the relationship between ping's TTL and count of hops in traceroute? When I tried something, I thing that it is

ping's TTL == traceroute hops - 2.

Is it correct? And why it is so? But in my images from terminal it is not so always. Thank you very much!?

Hello,

Hello,

Found this clarifying paragraph in the original internet protocol RFC791 document.

The Time to Live is an indication of an upper bound on the lifetime of
  an internet datagram.  It is set by the sender of the datagram and
  reduced at the points along the route where it is processed.  If the
  time to live reaches zero before the internet datagram reaches its
  destination, the internet datagram is destroyed.  The time to live can
  be thought of as a self destruct time limit.

Basically, it prevents a packet from looping around the network forever.

Cheers!

Kristof

41199
Views
15
Helpful
13
Replies