If I'm sniffing my computer and see some packet with TTL=64, does it means that the packet came from a computer inside my network, or it can be anyone in the WWW ?

I know what TTL is. But I'm trying to figure out what exactly TTL=64 means.

1

4 Answers

TTL is Time To Live. Each hop decrements this field by one, and if the value reaches 0, the packet is dropped (usually this happens only in loop situations). This makes sure that data packets are not congesting a network if there is an IP routing loop present. The sender of the packet can set the TTL to any value, up to 255.

Another possibility is you're seeing packets that never even reach the network outside of your computer, i.e.

PING localhost (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.134 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.139 ms

64 is the number of hops that the packet can travel before it is dropped. Hard to reach hosts that are across many hops of the Internet benefit from a larger TTL on packets. In multicast protocols 64 is used to restrict the packet to the same physical region. You may be seeing a multicast protocol.

if you research you will know that ttl=64 is basically tel's the which operating system server is using in your case it uses Linux based server ttl=128 windows os

1

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy