Diagnose Network by TTL Value

  • What is the TTL?

Under the Internet Protocol, TTL is an 8-bit field. In the IPv4 header, TTL is the 9th octet of 20. In the IPv6 header, it is the 8th octet of 40. The maximum TTL value is 255, the maximum value of a single octet. A recommended initial value is 64.



Various causes will lead to packets transmission failure to the destination in a specific time period. For instance, wrong routing table configuration may cause packet endless loop. The solution is to drop the packet after a period of time and then send a message to the sender and let it decide whether to retransmit the packet. When this happens, the packet will be retransmitted at the router which is wrongly configured in the routing table. TTL value will be deducted by 1 upon each retransmission until TTL becomes zero when the packet is dropped by the router, which causes transmission error in the network.

Default TTL value varies depending on the difference of the operating system and transmission protocol. Here I listed the default TTL values in TCP and UDP under common operating systems in table 1:

Operating system TCP UDP
AIX 60 30
DEC Patchworks V5 30 30
FreeBSD 2.1 64 64
HP/UX 9.0x 30 30
HP/UX 10.01 64 64
Irix 5.3 60 60
Irix 6.x 60 60
UNIX 255 255
Linux 64 64
MacOS/MacTCP 2.0.x 60 60
OS/2 TCP/IP 3.0 64 64
OSF/1 V3.2A 60 30
Solaris 2.x 255 255
SunOS 4.1.3/4.1.4 60 60
Ultrix V4.1/V4.2A 60 30
VMS/Multinet 64 64
VMS/TCPware 60 64
VMS/Wollongong 128 30
VMS/UCX (latest rel.) 128 128
MS Windows 95/98/NT 3.51 32 32
Windows NT 4.0/2000/XP/2003 Server 128 128

Table 1: Default TTL Value under Different Operating Systems

  • View TTL value of packets and analyze transmission error

When transmission error occurs in the network, we can view the TTL value of packets with Unicorn and determine whether the error is resulted from wrong routing configuration or other possible reasons in combination of the above table.  See the figure below:

As we can see from figure 1, TTL is 47. With the list TTL value above, we can determine the packets passed through 255-47=208 routers from the source to the destination machine, and the transmission is normal.

  • Notice:

  1. To determine how many routers a packet passed, you can deduct the TTL value of the packet you captured from the default TTL value of the source device.
  2. If you don't know the default TTL value of the source device, you can use the default TTL value which is lager than and most close to the TTL value of the packet;
  3. The peak TTL value is 255 as TTL field size is 1 byte.
  • Conclusion

If TTL value of the packets captured is too small, it indicate there may be a transmission error in the network. By checking the TTL value we can find out whether the network is normal or not.

Unicorn Network Analyzer How tos