what pattern does ttl usually follows? working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern.

Info: I am doing traceroute from: to

  • Were you doing a traceroute to/from when this capture was taken? What's the other IP in the packet? Which of the IPs is the source? Could you post hex dump (hexadecimal values in the lower pane) of 2-3 such packets?
    – Donbhupi
    Mar 5, 2015 at 20:48
  • The host is definitely doing a traceroute. There is a lot of detail about how that works here.
    – Eddie
    Mar 6, 2015 at 2:21

1 Answer 1


Like I mentioned in my comment above, this 3-packet TTL increment is typical of traceroute application. Since you're doing a traceroute from a Windows machine(, it sends 3 ICMP packets with TTL=1 to the remote IP and then keeps on incrementing by 1 after every 3 packets.

Since your question is about the TTL value in the replies it receives from the devices in the path, please read the following:
There's no global standard TTL value across all vendors but usually it is a multiple of 2. So, the TTL value in a capture on the client will usually follow the pattern: (2^x)-n, where n is the number of hops and x could be any positive integer.

For example, the device that is 3 hops away (see packet #27) has the IP and the TTL it sends is: (2^8)-3, i.e. 253.

Hope that helps!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.