What does TTL in ping mean? What is the difference between TTL=64 and 128? You can tell at a glance what device is on the other side.

Last week, I helped a colleague remotely check a printer that couldn't be connected. He sent me a screenshot of the ping.: from 192.168.1.1 Reply, time 1ms, TTL=64. He asked me, is this TTL delayed by 64 milliseconds? I laughed at that time. This 64 has nothing to do with milliseconds.

Later, I pinged several devices at home one by one, and found that the number became more and more interesting. It can't tell you the network speed directly, but it can help you roughly guess what device is on the other side and how many routes are in the middle. Today I will break down this TTL.

I made the same mistake when I first saw TTL, thinking it was time. Later, I looked up the packet capture log in the background of the router, and saw that every time the same packet jumped out, the number in the header was reduced by 1, which had nothing to do with the stopwatch.

TTL is not time, it is how many doors the data packet can pass through.

The three letters of TTL are Time To Live, which literally means "time to live", but don't think of it as milliseconds. It is a number from 0 to 255 in the header of the data packet. Each time it passes through a router, the router decrements this number by 1 and then continues forwarding. If it is reduced to 0 and has not reached the destination, the router will no longer send it and will send back a "timeout" message.

The TTL displayed in ping is the remaining number when the other party's reply packet jumps all the way to your computer. So it is not "a delay of 64 milliseconds", but "the other side sets a certain number at the beginning, and after it is subtracted several times on the way, 64 is left." It depends on the time, you have to look at the front 时间=1ms That column is not TTL. What does ping itself do? What does ping mean? Here, I used 32 bytes to run through four servers. I forgot to turn it over first.

You can think of it as the "limit of transit times" on express delivery. The shipper writes an initial number and tears off a grid every time it arrives at a transfer station. ； The package was torn to zero without signing for it, so the transfer station returned the package directly with the sentence "I can't deliver this order." What you see in the ping are the few spaces left when receiving the goods.

This "minus 1" rule also creates another command: tracert deliberately increases the TTL from 1 to upwards. When the first hop is reduced to 0, the first router is exposed, and the second hop is exposed to the next one, tracing out the path along the way. So TTL is not a decoration, it is an insurance against network loops.

Memorize these three numbers 64, 128, and 255 first.

Different systems set different initial TTLs for data packets. The most common ones are three. When you see the number in the reply, combined with the number of jumps in the middle, you can deduce what kind of system the other party is.

Note that the "initial value" here is not necessarily the same as the number displayed in ping. For example, if Windows on the opposite side initially displays 128, and there is a router in the middle, you may see 127. On the other hand, if the TTL you ping from the same device is several times smaller than yesterday, it is probably because the path has changed, not because the device has changed its system.

One more thing to note: Windows' ping outputs uppercase TTL, macOS and Linux output lowercase ttl, and Termux on Android is mostly lowercase. Uppercase and lowercase is just a display habit. Calculate numerical values ​​as they should. Don't treat them as two different things.

I pinged three devices at home.

The bare back watch didn't work, I actually typed it once and the numbers immediately matched. My main router is TP-LINK XDR6088, management address 192.168.1.1 , the desktop is Windows 11, and there is a QNAP NAS. All three are connected to the same router, with 0 hops in between, so the values ​​pinged are basically the initial values ​​of their respective systems.

• ping 192.168.1.1 ： The router returns TTL=64. The bottom layer of home routers is mostly Linux, which is initially 64.
• ping 192.168.1.20 ： Windows desktop computers return TTL=128.
• ping 192.168.1.88 ： QNAP NAS returns TTL=64 because it also runs Linux.

Switch to macOS and watch the same one 192.168.1.1 , the output line will be written as 64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=1.2 ms , the extra bytes and icmp_Don’t panic about seq. One is the packet size and the other is the serial number. They have little to do with your troubleshooting. The focus is still on the ttl and time columns.

Therefore, in the screenshot taken by a colleague with TTL=64, the other party is most likely the router, not the "printer delay of 64 milliseconds" as he thought. If the printer does not respond to ping, most likely the firewall has turned off ICMP, it has nothing to do with TTL.

Let’s talk about another counterexample: Ping a public network address, such as ping 114.114.114.114 , TTL is often neither 64 nor 128, because it takes several hops from your home to that server. This number is the "initial value minus the number of intermediate routers". It seems normal that it is smaller than 64. If you want to count how many cars passed by in the middle, use tracert. What does each hop of tracert mean? Here I also explained the screen full of asterisks.

I used my home broadband to ping twice. 114.114.114.114 , one time TTL=55, another time 56, the number of hops in between and which line to take, the operator has the final say. Don't expect this number to be exactly the same every time. Allow it to differ by 1, and then use your brain if the difference is more than 5.

The number is several times smaller than yesterday. Let’s first check if it’s gone too far.

One time, my NAS suddenly pinged TTL=60, which is usually 64. My first reaction was that the NAS system had been upgraded, but when I logged in I saw that the version had not changed. Then ran away tracert -d 192.168.1.88 Only then did I realize that the package did not go directly to the direct connection, but instead went around to a bypass router and back again, with 4 extra hops in the middle.

In this case, the road has changed. Either a bypass router or dual WAN has just been added, or a network cable has been connected incorrectly to form a temporary loop. The loop is more extreme. The data packet will go back and forth between the two routers, and the TTL will be reduced all the way to 0. Finally, the ping will directly report "expired in transit", which in English is TTL expired in transit. When you see this line of text, don't reinstall the system. First check whether a network cable is plugged in twice, or the LAN ports of two routers are plugged into each other.

At that time, my home had a main router and a bypass router with OpenWrt installed. The bypass router only connected the LAN port and did not turn off the bridge. As a result, there was an extra door in the LAN. The NAS packet is first handed to the bypass router by the main router, and then handed back by the bypass router, so the TTL is reduced by 2. After straightening out the bypass bridging and DHCP, the TTL returned to 64. Therefore, the bypass router is not adjusted properly. The most obvious thing is not that I cannot connect to the Internet, but that the numbers are weird.

If the number only occasionally differs by 1, don't be too nervous. It may be due to load balancing or a temporary bypass on the operator side. Stable and reproducible "several few less" are worth checking the route. Why does the routing table make packets go around far? What does routing table mean? I used a VPN to disconnect the internet.

I have stepped on both of the two pitfalls that are most likely to be misjudged.

The first pitfall is to regard TTL as a device fingerprint, which is too absolute. 64 and 128 are common default values, not legal requirements. Some security-hardened systems will deliberately change the initial TTL to 100, 60 or even 1, just to prevent others from seeing the system type at a glance. So when you see 64, you can only say "It's most likely a Linux system", but you can't say "It must be a router".

The second pitfall is that the device does not respond to ping at all. If you guess the TTL, it is equivalent to guessing in the air. Many Windows default firewalls block inbound ICMP, and some routers also turn off WAN port ping. At this time, there is no TTL. To determine whether the device is online, you cannot rely solely on ping. You must also use actual services such as web pages, ports, and shared directories to confirm. Want to find out who is grabbing the MAC and IP? What does ARP mean? That time when the NAS was on and off, I could tell by running arp -a.

The third pitfall is IPv6. This field in IPv6 packets is not called TTL, but Hop Limit. It has the same effect, and it also decreases by 1 for each hop. on Windows ping -6 For an IPv6 address, what you see may be the hop limit, not the ttl. Don't think that ping is broken when you see this.

If you really want to use it to check the fault, follow this order.

Condensing the above into four steps, this is how I usually check:

1. First ping your own gateway, for example 192.168.1.1 , whether it is possible to look back or not, whether TTL is common 64.
2. Then ping a Windows computer on the same network segment. Normally you should see 128 or 127.
3. Ping a public network address to see if the TTL is obviously low or if there is any "expiration in transit".
4. If you find a sudden change in the number, run tracert to count the paths. Check the line first and then the route.

Ultimately, a TTL is just a clue, not a verdict. It can help you dismantle one less machine and restart the router one less time, but it cannot replace real business verification. Next time you see 64 in ping, don’t pronounce it as 64 milliseconds, think about it first: This pack starts from the opposite side, how many breaths are left in the end.

In addition, if the ping does not return, it does not mean that the other party is shut down. Some printers, cameras, and Linux hosts ignore ICMP by default, but web pages, sharing, and video streaming are all normal. To determine life and death, multiple methods must be used together. TTL is just a casual clue. Don't use it as the only evidence.