TTL value of a packet is supposed to decrease 1 at each router from 255 down to zero as follows:
But when I ping to 8.8.8.8 the TTL starts at 253 and doesn't change:
How can this be explained? Why does it start from 253 but not 255? And why doesnt it decrease at each router? (Why does it stays constant at 253?)
The displayed TTL is a value from the ping reply packet. The host sending that reply decides the initial TTL for that packet, and it's decremented once per hop en-route to you.
Allow me to show an example from the perspective of my home:
jsw@athena:~$ traceroute -q1 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets
1 172.19.87.1 1.351 ms
2 142.254.146.57 8.264 ms
3 74.128.7.229 760.606 ms
Pinging my default gateway results in replies with TTL=64 because that's the initial TTL value used by my home router.
jsw@athena:~$ ping 172.19.87.1
PING 172.19.87.1 (172.19.87.1): 56 data bytes
64 bytes from 172.19.87.1: icmp_seq=0 ttl=64 time=1.232 ms
Pinging the second hop in my outbound traceroute gets me replies with TTL=254. I can assume they were initially sent with TTL=255 by the ISP router and decremented once as they passed through my home router. Note the ISP router uses a different initial TTL value than my home router; each host can choose its own initial value.
jsw@athena:~$ ping 142.254.146.57
PING 142.254.146.57 (142.254.146.57): 56 data bytes
64 bytes from 142.254.146.57: icmp_seq=0 ttl=254 time=9.707 ms
Pinging the third hop results in replies that have TTL=62 when they arrive at my home PC.
jsw@athena:~$ ping 74.128.7.229
PING 74.128.7.229 (74.128.7.229): 56 data bytes
64 bytes from 74.128.7.229: icmp_seq=0 ttl=62 time=18.884 ms
Why does it start from 253 but not 255? And why doesnt it decrease at each router? (Why does it stays constant at 253?)
It is not starting at 253, the reply is ending with 253. Different ping applications on different host OSes can start with different values, e.g. 32, 64, 128, etc. The ICMP echo request will start with its initial value on your host, and it will decrement at each router in the path. When the destination host replies, it will start with its own initial value, and that will be decremented until it reaches your host. What you are seeing is the result of the decrements from the ping target to your host.
The traffic that passing between network interfaces must go through the Forwarding Engine. The Forwarding Engine is a component that directs packets to their destination. During the process of directing packets to their destination, a few things will happen such as:
Checking / decreasing the TTL ,TTL value set for each operating system set different values for example below.
Linux kernel 2.4 ==>>255 for TCP, UDP and ICMP
Linux kernel 4.10==>> 64 for TCP, UDP and ICMP
Windows XP ==>>128 for TCP, UDP and ICMP
Windows 10 ==>128 for TCP, UDP and ICMP
For example if you ping linux kernel on reverse traffic that is responce traffic echo reply traffic decrement it's value to -1 eact time traffic passes through L3 devices.
{}).