Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or greater?


Packets will be delivered with TTL >= 1.

The Internet Protocol RFC 760 says "Time to Live: 8 bits [...] If this field contains the value zero, then the datagram should be destroyed." If the router decrements the TTL and finds zero, it should send ICMP TTL expired message to the originator; if there's still any life in the packet it forwards it.

A quick test across two hosts a few routers apart confirms it:

Doesn't arrive with sending TTL 3

$ ping -c 1 -t 3
From icmp_seq=1 Time to live exceeded

Does arrive with sending TTL 4

$ ping -c 1 -t 4
64 bytes from icmp_req=1 ttl=62 time=51.0 ms

On the receiving end arrives with TTL 1

17:53:19.346312 IP (tos 0x0, ttl 1, id 12703, offset 0, flags [DF], proto ICMP (1), length 84) > ICMP echo request, id 4949, seq 1, length 64

Possible? Yes, if the upstream router hasn't dropped it, ignoring standards. Usual? No. A TTL value of 1 is the lowest that should get forwarded.

Not the answer you're looking for? Browse other questions tagged or ask your own question.