Time to Live

What is IPv4 Time to Live (TTL)?

The Time to Live (TTL) is a field in the IPv4 header that specifies the maximum number of hops (routers) a packet can pass through before being discarded, preventing packets from circulating endlessly.

Why is IPv4 Time to Live (TTL) useful?

TTL prevents routing loops by limiting the lifespan of packets in the network, ensuring that undeliverable packets don’t congest the network indefinitely.

How does IPv4 Time to Live (TTL) work?

Each router that forwards the packet decrements the TTL value by one. When TTL reaches zero, the packet is discarded and typically an ICMP “Time Exceeded” message is sent back to the sender.

Where is IPv4 Time to Live (TTL) used?

TTL is used in every IPv4 packet across all IP networks to control packet lifetime and avoid routing loops.

Which OSI layer does IPv4 Time to Live (TTL) belong to?

TTL is a feature of the Network Layer (Layer 3), embedded in the IPv4 header.

Is IPv4 Time to Live (TTL) Windows specific?

No, TTL is a fundamental part of IPv4 implemented across all operating systems, including Windows.

Is IPv4 Time to Live (TTL) Linux specific?

No, Linux and other OSes implement TTL as part of the IPv4 protocol stack.

Which Transport Protocol is used by IPv4 Time to Live (TTL)?

TTL is independent of transport protocols; it applies to all IPv4 packets regardless of whether they carry TCP, UDP, or others.

Which Port is used by IPv4 Time to Live (TTL)?

TTL does not use ports as it functions at the network layer before transport layer processing.

Is IPv4 Time to Live (TTL) using client-server model?

TTL is a network mechanism and is independent of any application communication model like client-server.

What is the default TTL value in IPv4 packets?

The default TTL value for many operating systems and devices is typically set to 64, though it can vary depending on the OS and configuration.

How does TTL prevent routing loops?

TTL prevents routing loops by limiting the number of hops a packet can make. If a packet circulates through the same routers indefinitely, the TTL value will eventually reach zero, causing the packet to be discarded.

Can TTL be set to zero?

Setting TTL to zero is not practical, as it would mean the packet would be discarded immediately. However, it can be set to a low value for testing purposes, such as in “traceroute” diagnostics.

How can TTL be used for network diagnostics?

TTL is used in tools like traceroute or ping to identify the path taken by packets across the network. Traceroute sends packets with increasing TTL values, allowing the user to see each hop along the way.

What happens when TTL reaches zero?

When the TTL reaches zero, the packet is discarded by the router. Typically, an ICMP Time Exceeded message is sent back to the sender, notifying them of the expired TTL.

Can TTL be changed during transmission?

TTL can be modified at each hop by the routers, but the sender can set the initial TTL value before transmission. Routers typically decrement TTL as they forward the packet.

Is TTL the same as packet lifetime?

TTL is a mechanism that limits the lifetime of a packet, but it is not an exact representation of the actual time a packet spends in transit. It measures hops rather than time in seconds.

Does TTL affect the speed of packet delivery?

No, TTL does not affect the speed of packet delivery. It only limits the number of hops a packet can make before being discarded.

Is TTL affected by the size of the packet?

No, TTL is independent of the packet size. It only refers to the number of hops a packet can take, not how much data it contains.

Can TTL be used to estimate network latency?

TTL itself does not measure latency. However, by using tools like traceroute, you can estimate latency by measuring the time it takes for each hop to respond.

How do routers handle TTL?

Routers decrement the TTL by one each time they forward a packet. If TTL is zero before the packet reaches its destination, the router discards it and sends an ICMP “Time Exceeded” message back to the sender.

Does TTL impact routing decisions?

No, TTL is not involved in routing decisions. Routers make forwarding decisions based on destination IP addresses, not TTL values.

Can TTL values be customized for specific types of traffic?

Yes, TTL values can be customized for specific applications or traffic types, depending on the network configuration. Some protocols may require different TTL values based on performance or security needs.

Does TTL help with congestion control?

No, TTL does not directly contribute to congestion control. Its purpose is to prevent routing loops, not to manage network congestion.

Is TTL relevant in modern networking?

Yes, TTL is still relevant in modern networking as a mechanism to prevent packets from circulating endlessly due to routing loops. It is also helpful in troubleshooting network paths.

Can TTL values affect the effectiveness of network protocols?

While TTL itself doesn’t directly affect protocol operations, a low TTL could cause packets to expire before reaching their destination, impacting the success of time-sensitive protocols.

Is TTL used in IPv6?

Yes, IPv6 uses a similar field called Hop Limit, which functions in the same way as TTL in IPv4 to prevent packets from circulating indefinitely.

What is the role of TTL in dynamic routing?

While TTL does not directly impact dynamic routing protocols (like OSPF or BGP), it helps to ensure that routing loops are avoided in large, complex networks that rely on these protocols.

Topics in this section,

  • In this section, you are going to learn

  • Terminology

  • Version Info

Objective

Validate that the IPv4 TTL (Time to Live) field prevents infinite packet looping by limiting the number of hops a packet can traverse.

Test Setup

  • Identify a remote host more than two hops away. - Public DNS server (e.g., 8.8.8.8) or any major website can be used.

    test:~$ traceroute google.com
traceroute to google.com (142.251.220.46), 64 hops max
1   192.168.1.1  6.624ms  0.599ms  1.414ms
2   10.10.9.1  0.959ms  0.979ms  0.902ms
3   103.160.103.17  2.194ms  2.551ms  2.040ms
...
10   142.251.220.46  24.051ms  24.223ms  23.414ms

    Note

    Each line in the traceroute output represents a single hop (router) along the path.

Procedure and Analysis

  • Step 1: Send a Packet with Low TTL

    • Use the ping command with the -t option to set TTL = 2.

    • This ensures the packet cannot travel beyond two hops.

    test:~$ ping -t 2 google.com
PING google.com (142.251.220.46) 56(84) bytes of data.
From 10.10.9.1 icmp_seq=1 Time to live exceeded
From 10.10.9.1 icmp_seq=2 Time to live exceeded
...
^C
--- google.com ping statistics ---
10 packets transmitted, 0 received, +10 errors, 100% packet loss, time 9012ms

  • Step 2: Observe the Ping Output

    • The ping fails to reach the destination.

    • Each response shows Time to live exceeded, indicating the packet was dropped after exceeding TTL.

  • Step 3: Wireshark Analysis

    • Outgoing Packet (Echo Request) - IPv4 Header TTL field = 2 - Source IP = your laptop - Destination IP = remote host (e.g., google.com)

    • Incoming Packet (TTL Exceeded) - ICMP error message from the router - Source IP = router’s IP (e.g., 10.10.9.1) - ICMP Type = 11 (Time Exceeded) - ICMP Code = 0 (TTL exceeded in transit)

Note

  • The TTL field prevents routing loops by decrementing at each hop and discarding packets with TTL = 0.

  • Routers generate ICMP Time Exceeded messages to notify the sender of packet drop.

  • This behavior is essential for network stability and efficient packet delivery.

Wireshark Capture

Download wireshark capture

Test Case 2: TTL Decrement by Each Router

Objective

Validate that each router correctly decrements the Time to Live (TTL) field in an IPv4 packet by one at each hop.

Test Setup

This test uses three subnets and four virtual machines (VMs): a client, two routers, and a server. The packet will traverse from the client, through the two routers, to the server.

  • Network Diagram: * Subnet A (192.168.1.0/24): Client ↔ Router 1 * Subnet B (192.168.2.0/24): Router 1 ↔ Router 2 * Subnet C (192.168.3.0/24): Router 2 ↔ Server

  • VM Configuration:

    • Client VM:

      test:~$ sudo ip addr add 192.168.1.10/24 dev enp0s8
test:~$ sudo ip link set enp0s8 up
test:~$ sudo ip route add default via 192.168.1.1

    • Router 1 VM:

      test:~$ sudo ip addr add 192.168.1.1/24 dev enp0s3
test:~$ sudo ip addr add 192.168.2.1/24 dev enp0s8
test:~$ sudo ip link set enp0s3 up
test:~$ sudo ip link set enp0s8 up
test:~$ sudo sysctl -w net.ipv4.ip_forward=1
test:~$ sudo ip route add 192.168.3.0/24 via 192.168.2.2

      Note

      To make IP forwarding permanent, edit /etc/sysctl.conf and uncomment net.ipv4.ip_forward=1.

    • Router 2 VM:

      test:~$ sudo ip addr add 192.168.2.2/24 dev enp0s3
test:~$ sudo ip addr add 192.168.3.1/24 dev enp0s8
test:~$ sudo ip link set enp0s3 up
test:~$ sudo ip link set enp0s8 up
test:~$ sudo sysctl -w net.ipv4.ip_forward=1
test:~$ sudo ip route add 192.168.1.0/24 via 192.168.2.1

    • Server VM:

      test:~$ sudo ip addr add 192.168.3.10/24 dev enp0s8
test:~$ sudo ip link set enp0s8 up
test:~$ sudo ip route add default via 192.168.3.1

Procedure and Analysis

  • Start Capture: Begin a Wireshark capture on the Server VM’s interface.

  • Send Ping: From the Client VM, send a single ICMP echo request to the Server.

    test:~$ ping -c 1 192.168.3.10
PING 192.168.3.10 (192.168.3.10) 56(84) bytes of data.
64 bytes from 192.168.3.10: icmp_seq=1 ttl=62 time=5.22 ms
--- 192.168.3.10 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms

  • Trace Route: Optionally, use traceroute from the Client VM to visualize each hop.

    test:~$ traceroute 192.168.3.10

    Note

    Traceroute should show three hops: 1. Router 1 (192.168.1.1) 2. Router 2 (192.168.2.2) 3. Server (192.168.3.10)

Wireshark Capture

Note

  • Request Packet: TTL starts at 64. After passing through two routers, TTL = 62 at the server.

  • Reply Packet: TTL also starts at 64 from server, decremented by two hops to 62 when it reaches the client.

  • Wireshark analysis will confirm the decrement at each router by comparing the initial TTL with the final TTL.

  • This demonstrates correct TTL handling to prevent routing loops.

TTL (Time to Live) - Testcases

TTL (Time to Live) - Test Cases

#

Test Case

Description

Expected Result

1

TTL = 64

Standard TTL value

Packet forwarded, TTL decremented

2

TTL = 1

Minimum valid TTL

Packet dropped at first hop, ICMP Time Exceeded sent

3

TTL = 0

Invalid TTL

Packet dropped immediately

4

TTL = 255

Maximum TTL

Packet forwarded, TTL decremented

5

TTL Decrement by Router

Router receives packet

TTL reduced by 1

6

TTL Expiry at Router

TTL reaches 0

ICMP Time Exceeded sent to source

7

TTL with Looping Route

Packet loops

TTL eventually expires

8

TTL with Static Route

TTL decremented normally

Packet forwarded

9

TTL with Dynamic Route

TTL decremented normally

Packet forwarded

10

TTL with Fragmented Packet

Each fragment has same TTL

TTL decremented per fragment

11

TTL with NAT

TTL decremented before translation

NAT does not reset TTL

12

TTL with Firewall

TTL checked for filtering

Packet allowed or dropped

13

TTL with ACL

ACL does not inspect TTL

Packet filtered based on IP/port

14

TTL with VPN Tunnel

TTL decremented before encapsulation

Tunnel endpoint receives packet

15

TTL with GRE Tunnel

TTL decremented before encapsulation

GRE header added

16

TTL with IPsec Tunnel

TTL decremented before encryption

Packet encrypted and forwarded

17

TTL with MPLS

TTL copied to MPLS label

Decremented per hop

18

TTL with ICMP Echo Request

Ping with TTL = 1

ICMP Time Exceeded received

19

TTL with ICMP Echo Reply

Ping reply TTL = 64

Reply received with TTL intact

20

TTL with Traceroute

TTL incremented per probe

ICMP Time Exceeded received from each hop

21

TTL with Broadcast Packet

TTL = 1

Packet not forwarded beyond subnet

22

TTL with Multicast Packet

TTL controls scope

Packet dropped after TTL expires

23

TTL with Loopback Address

TTL not decremented

Packet processed locally

24

TTL with Private Address

TTL decremented normally

Packet routed within private network

25

TTL with Public Address

TTL decremented normally

Packet routed to internet

26

TTL with Logging Enabled

TTL logged

TTL value recorded in logs

27

TTL with Monitoring Tool

TTL captured

TTL visible in packet capture

28

TTL with QoS

TTL not affected by QoS

Packet prioritized

29

TTL with Load Balancer

TTL decremented before forwarding

Load balancer does not reset TTL

30

TTL with Proxy

TTL decremented before proxy

Proxy may reset TTL

31

TTL with NAT Hairpinning

TTL decremented

Packet routed internally

32

TTL with TTL Expiry Logging

TTL = 1

Expiry logged by router

33

TTL with TTL-Based Filtering

TTL < threshold

Packet dropped

34

TTL with TTL-Based Routing

TTL used in policy

Packet routed based on TTL

35

TTL with TTL Reset by Device

Device resets TTL

Packet appears fresh

36

TTL with TTL Preservation

TTL unchanged by device

Packet continues with original TTL

37

TTL with TTL Manipulation Attack

TTL set low

Packet dropped early

38

TTL with TTL Spoofing Detection

TTL anomaly detected

Packet flagged or dropped

39

TTL with TTL Expiry Notification

ICMP Time Exceeded sent

Source notified of drop

40

TTL with TTL Expiry Suppression

ICMP disabled

Packet dropped silently

41

TTL with TTL in Fragmented Packet

All fragments have same TTL

TTL decremented per fragment

42

TTL with TTL in Reassembled Packet

TTL from first fragment used

Packet reassembled correctly

43

TTL with TTL in IPv6

Not applicable

IPv6 uses Hop Limit

44

TTL with TTL in IPv4 Header

TTL field = 8 bits

Value between 0255

45

TTL with TTL in Routing Loop Detection

TTL used to detect loops

Loop broken by TTL expiry

46

TTL with TTL in Path MTU Discovery

TTL not used

PMTUD uses DF bit and ICMP

47

TTL with TTL in BGP

TTL used in TTL Security Check

Protects against spoofing

48

TTL with TTL in OSPF

TTL = 1 for hello packets

Ensures packets stay on local link

49

TTL with TTL in RIP

TTL not used

RIP uses hop count

50

TTL with TTL in Application Layer

App reads TTL

Used for diagnostics or routing decisions

  • Reference links