0

Acording to Wikipedia IPv4 article for TTL header field:

An eight-bit time to live field limits a datagram's lifetime to prevent network failure in the event of a routing loop. It is specified in seconds, but time intervals less than 1 second are rounded up to 1. In practice, the field is used as a hop count—when the datagram arrives at a router, the router decrements the TTL field by one. When the TTL field hits zero, the router discards the packet and typically sends an ICMP time exceeded message to the sender.

This means that if a TCP or UDP packet expire, the router send an ICMP reporting packet to the origin host?

3
  • 1
    That is correct (ICMP type 11)
    – Ron Trunk
    Jul 6, 2022 at 15:04
  • 3
    "This means that if a TCP or UDP packet expire" Packets are IP datagrams. TCP segments and UDP datagrams are the payload of IP packets. It is the IP packets that expire, not TCP segments or UDP datagrams.
    – Ron Maupin
    Jul 6, 2022 at 15:36
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 22:58

2 Answers 2

1

This means that if a TCP or UDP packet expire, the router send an ICMP reporting packet to the origin host?

No and yes.

TCP segments or UDP datagrams cannot carry a TTL value themselves.

If the TTL on an IP packet runs out, the router that expires the packet returns an ICMP TTL expired in transit (11/0) to the source IP address.

You can very easily test that by using the traceroute / tracert utility or by running ping with the -i (Windows) or -t (Linux) option.

For completeness: no ICMP TTL expired is returned for ICMP packets themselves. The only exception to that exception are ICMP echo request packets as used with ping with do cause expired messages.

0

Finally I modified the default ttl:

# cat /proc/sys/net/ipv4/ip_default_ttl
64

to:

# echo 1 | sudo tee /proc/sys/net/ipv4/ip_default_ttl
1

And the packet capture shows that after a TCP packet with TTL 1, there is an ICMP type 11 "Time-to-live exceed" from the router.

So the answer is yes, the router reply with an ICMP to an expire TCP or UDP.

1
  • 4
    "he router reply with an ICMP to an expire TCP or UDP." The TTL is in the IPv4 packet (Hop Limit for IPv6) header, not for TCP or UDP. TCP and UDP do not have such an expiration, and routers do not look at the IP packet payload (TCP, UDP, etc.), only the IP packet header.
    – Ron Maupin
    Jul 6, 2022 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.