11

I work for a VoIP service provider and I am working an issue with a customer who has a cable internet connection that's throwing me for a loop.

He has a single block, which we'll pretend is 70.141.15.0/29, with the gateway at .1 and routers at .2 and .3. Both routers are connected to his cable modem which is, to the best of our knowledge, set to whatever cable providers imagine "bridge mode" is.

I am pinging both these routers simultaneously from the same box, which is a linux system connected to fiber from (probably) Level(3). So needless to say, nobody on the planet knows how many nodes there are between here and there. But check out the ping results.

To the first router:

64 bytes from 70.141.15.2: icmp_seq=2637 ttl=47 time=45.0 ms
64 bytes from 70.141.15.2: icmp_seq=2638 ttl=47 time=39.2 ms
64 bytes from 70.141.15.2: icmp_seq=2639 ttl=47 time=37.3 ms
64 bytes from 70.141.15.2: icmp_seq=2640 ttl=47 time=46.1 ms
64 bytes from 70.141.15.2: icmp_seq=2641 ttl=47 time=45.8 ms
64 bytes from 70.141.15.2: icmp_seq=2642 ttl=47 time=46.5 ms
64 bytes from 70.141.15.2: icmp_seq=2643 ttl=47 time=40.9 ms

From the second:

64 bytes from 70.141.15.3: icmp_seq=631 ttl=239 time=54.7 ms
64 bytes from 70.141.15.3: icmp_seq=637 ttl=239 time=40.5 ms
64 bytes from 70.141.15.3: icmp_seq=638 ttl=239 time=40.3 ms
64 bytes from 70.141.15.3: icmp_seq=639 ttl=239 time=38.4 ms
64 bytes from 70.141.15.3: icmp_seq=640 ttl=239 time=44.9 ms
64 bytes from 70.141.15.3: icmp_seq=641 ttl=239 time=38.4 ms
64 bytes from 70.141.15.3: icmp_seq=642 ttl=239 time=38.8 ms

Check out the TTL values. Does this make sense? These devices are directly adjacent to each other, plugged into that modem via separate switch ports. How can one appear to have nearly 200 more hops? From pinging other sites I'm getting the impression that TTL is just not implemented the way I think it is. I doubt there are 200 hops between me and 4.2.2.2, or woot.com, yet I get under 50 TTL results from both of those.

One of these routers (the one with the higher TTL) is from Fortinet, while the other one is a custom Linux-based device. I'm pretty sure the Forti has a home-rolled network stack, while the Linux box uses whatever came with the source tarball the hardware devs downloaded. Is it likely that ICMP echo is implemented in a bizarre form on one of these and deliberately sends all replies with a TTL of 50?

I also notice that one of the only sites I can find that replies with sane-looking TTL is slashdot, and I can imagine that their servers and routers might be a little less "whatever we found in the garage" than the average website, which sort of makes me feel like I might be on the right track with that last supposition.

To sum up: does TTL on ping mean anything reliable whatsoever?

Improve this question
3
  • 4
    I read somewhere that Windows XP and Windows 7 set there TTL as 128 and for Linux systems they generally have TTL 64. Not perfect but very useful to know sometimes.
    – Sean
    Aug 17, 2015 at 9:06
  • 128-Windows, 64-most Linux and routers, 60-very rare, 32-Windows 95. And no one uses 63, it is probably hitting another router on the return path.
    – Fred Phillips
    Apr 1, 2018 at 0:23
  • try "Tracert [IP ADDRESS]" to see the total number of routes. If the system Starts at 64 TTL then if you TRACERT a device with one hop away you will get TTL=63. I tried and that's what I got. I always wonder TTL... hmm cool 😎
    – user56130
    Mar 19, 2019 at 23:58

2 Answers 2

Reset to default
25

So needless to say, nobody on the planet knows how many nodes there are between here and there.

I know how many nodes. There are exactly 16. The reason you get different responses is because different operating systems use different starting values for TTL. Some devices use 255, while others use 63. So, one of the devices you are pinging sends the reply with the TTL set to 255. By the time it gets back to you, it has decremented to 239. That's 16 hops.

The other device you ping sets the TTL to 63. So when it gets to you, the value is 47.

255-239 = 63-47 = 16.

If you want to be sure about the number of hops between you and the target, use traceroute.

Improve this answer
3
  • Thank you! I was making an assumption I now realize was baseless (that the return packet TTL was in any way dictated by the request packet TTL). One more question: are 255 and 63 standards-based values or arbitrary? That is, can I safely assume that any three-digit TTL started life as 255, etc?
    – DTD
    Nov 7, 2014 at 3:15
  • 3
    I don't think there are "standards" about this. OTOH, I've never seen a system that wasn't one or the other.
    – Ron Trunk
    Nov 11, 2014 at 13:00
  • 63 sounds like an uncommon value for an initial TTL.
    – JeanPierre
    Jul 30, 2018 at 20:48
2

TTL values are determined by the remote machine. For example, if you ping a Linux machine, its originating TTL value is 64. Depending on how many routers it crosses to get back to you, the TTL is deducted by a value of 1. So if you ping 8.8.8.8, which is Googles nameserver, it has an originating value of 128. By the time it gets back to you, it may have a value of 121 (it does for me). That means it crossed 7 networks to get to me and it was a windows machine.

Common TTL values

  • Router - 255
  • Windows - 128
  • Linux-Mac - 64
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.