0

I have two questions that i wanted to ask before. What is TTL?! I know that it's time to live for packet to die it count how many hops you jump in it every icmp but i don't know how it works and what are the rules. When ever i search for 0.0.0.255 (Wildcard mask) i've never found a good result The net mask let you specify the host and the network id what does wildcard do and why we replace the net mask with wildcard in routing? Thank you for your care.

  • 1
    Welcome to NE, we hope you will both contribute to and learn from this community. If you have two unrelated questions, you should post them as two different questions. – YLearn Dec 1 at 21:15
0

Practically, the TTL value is decreased by any router that forwards the packet. Once the counter reaches zero the packet is dropped. The TTL is a safeguard to eliminate looping packets, so they don't circulate endlessly.

Please post the wildcard question separately and provide more context.

0

TTL is used in two contexts: IP packets and DNS queries. I assume you mean the former.

The TTL value is initially set by the sending host (some operating systems set the initial TTL value to the maximum, 255, while others -- Macs for instance -- set it to 64). As the packet travels to the destination, every router along the way decrements the TTL value before forwarding the packet. If the TTL value is zero after decrementing it, the router instead drops the packet and sends an ICMP Time Exceeded message (code 11) back to the original sender.

Questions about DNS are off topic here, but you can ask questions about DNS TTL on Server Fault.

0

Here's a sample Cisco IPv4 OSPF configuration from https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-mt/iro-15-mt-book/iro-cfg.html

router ospf 109
  network 192.168.129.16 0.0.0.3 area 20

In that case, the 0.0.0.3 is a "wildcard mask". Any interface with an IP address that matches "192.168.129.16 0.0.0.3" will have OSPF enabled on the interface and be assigned to area 20.

But what IP's match "192.168.129.16 0.0.0.3" ?

The 0.0.0.3 is the "wildcard". It indicates what bits do not need to match. Here's what 192.168.129.16 looks like in binary:

11000000.10101000.10000001.00010000

Here's what 0.0.0.3 looks like in binary:

00000000.00000000.00000000.00000011

So that means that interfaces with IP addresses that match the following 4 will "match", because we do not care about the last two bits:

11000000.10101000.10000001.00010000   192.168.129.16
11000000.10101000.10000001.00010001   192.168.129.17
11000000.10101000.10000001.00010010   192.168.129.18
11000000.10101000.10000001.00010011   192.168.129.19

In this case, "192.168.129.16 0.0.0.3" happens to align with 192.168.129.16/30. But that's just because the network engineer configured the wildcard bits to match the subnet.

So if our router had IP address 192.168.129.17 assigned to an interface, OSPF would be enabled and in area 20. We could have configured the router like this:

router ospf 109
  network 192.168.129.17 0.0.0.0 area 20

With the exact same effect, but most network engineers tend to use wildcard bits to match the subnet of the interface, rather than the IP address of the interface.

Some people call wildcard bits an "inverse netmask" but that is WRONG. They are a list of bits that do not need to match.

It is perfectly legal syntax to have "discontiguous wildcard bits". For example 0.0.2.2 would result in wildcard bits like this:

00000000.00000000.00000010.00000010

But that is poor network engineering. Just as programmers should comment their code and use descriptive variable names, network engineers should avoid configurations that are hard for humans to understand.

Another common mistake among network engineers deals with wildcard bits in access-lists. These are both valid syntax for an IPv4 IOS access-list

access-list 101 permit tcp 192.168.129.0 0.0.0.255 host 1.1.1.1 eq 80
access-list 101 permit tcp 192.168.129.0 255.255.255.0 host 1.1.1.1 eq 80

The first example matches source ip addresses 192.168.129.0/24 (because the last 8 bits are "wildcards")

The second example matches every source IP address on the internet which ends with a 0. *.*.*.0 (because the first 24 bits are "wildcards"). That is obviously not what the network engineer intended. That type of misconfiguration has resulted in security incidents.

To add insult to injury, Cisco ASA firewalls use netmask syntax in their ACLs:

access-list extended permit tcp 192.168.129.0 255.255.255.0 host 1.1.1.1 eq 80

On an ASA that matches source IP 192.168.129.0/24.

On a Cisco IOS box that is invalid syntax (due to the "access-list extended" prefix), but has a tendency to trick network engineers into writing netmask syntax in an IOS ACL resulting in a security incident.

Fortunately, Cisco has moved (mostly) away from wildcard syntax with IPv6. IPv6 routing protocols are enabled per interface. IPv6 access-lists use CIDR syntax on most platforms.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.