0

When I ping the last three hops of a traceroute path to facebook.com from my location, the ICMP echo-reply packets I get back all have a TTL of respectively 58, 57 and 56. The hops in question are the 6th, 7th and 8th hops from my machine.

On the other hand, the TTLs of ICMP time-exceeded messages for packets expiring on those three hops, have all a reasonable value: 246, 248, 249.

Now, the return path might well not be the same as the forward path and it might not be the same for ICMP messages of different types.

But where could such a difference come from? A 200-hop cycle along path? Or ICMP echo-reply packets being generated with a low TTL (much lower than 255: does this even happen?)?

Improve this question
6
  • 1
    I suggest to modify your title to "Why forward ICMP packets have lower TTL than return packets ?" It's more accurate I think
    – mveroone
    Sep 10, 2013 at 12:31
  • Yeah, good point. Done :)
    – Ricky Robinson
    Sep 10, 2013 at 12:41
  • Doesn't it make sense that "time-excedded" messages uses the maximum TTL possible ? they are made to tell you your echo-request had a too low TTL after all
    – mveroone
    Sep 10, 2013 at 12:59
  • Yes, sure. Time-exceeded messages have exactly the TTL I would expect from any other packet coming from their respective source. What I can't explain is why echo-replies have such a low value.
    – Ricky Robinson
    Sep 10, 2013 at 13:03
  • 1
    Maybe echo-replies use the same TTL as echo-request which have 64 by default on most "ping" implementations (wild guess)
    – mveroone
    Sep 10, 2013 at 13:27

1 Answer 1

Reset to default
1

As suggested by the user kwaio, the default (or a common) TTL value to use when generating ICMP echo-request and echo-reply packets is 64.

In my case, the first routers along my selected path responded with an echo-reply message with TTL=255 (at the source), while the last ones with TTL=64.

It appears instead that ICMP time-exceeded messages were created in all cases with a TTL of 255.

After some digging, I found out that different vendors and different OS's adopt different initial TTLs for different protocols: binbert.com/blog/2009/12/default-time-to-live-ttl-values

An interesting implication of this is that you can take identify the manifacturer of a given router by letting a packet expire on it and by sending it a ping. More details here: TTL-based Fingerprinting and MPLS and the full article: "Network Fingerprinting: TTL-Based Router Signatures".

Improve this answer
1
  • 1
    You may mark the answer as accepted yourself =) (and i would suggest removing your comment to add it in the answer by editing it)
    – mveroone
    Sep 11, 2013 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .