logo elektroda
logo elektroda
X
logo elektroda

Explanation of strange TTL ping field values and tracert times

ckeddi1 14994 2
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
  • #1 12932956
    ckeddi1
    Level 10  
    Hello,

    I have two questions, so I can't understand the value of the TTL field. I did a test by pinging wp.pl and the value of this field as below is 245.

    Pinging wp.pl [212.77.100.101] with 32 bytes of data:
    Reply from 212.77.100.101: bytes=32 time=34ms TTL=245
    Reply from 212.77.100.101: bytes=32 time=23ms TTL=245
    Reply from 212.77.100.101: bytes=32 time=22ms TTL=245
    Reply from 212.77.100.101: bytes=32 time=25ms TTL=245

    By doing tracert, you can see that it takes 6 jumps to reach wp.pl.

    Tracing route to wp.pl [212.77.100.101]
    over a maximum of 30 hops:

    1 36ms 1ms 1ms 192.168.1.1
    2 8ms 8ms 14ms 10.4.0.1
    3 11 ms 8 ms 9 ms tomorrow-r0-p2-gw0.eaw.com.pl [78.152.21.201]
    4 21ms 21ms 20ms WP.plix.pl [195.182.218.204]
    5 25 ms 25 ms 24 ms rtr2.rtr-int-2.adm.wp-sa.pl [212.77.96.69]
    6 26 ms 32 ms 23 ms www.wp.pl [212.77.100.101]

    trace complete.

    So if the ping starts with 255 then why don't I get TTL=249 in response? I also pinged my router as well as another hop and this is where the magic happens, I don't know how I would interpret it.

    Pinging 192.168.1.1 with 32 bytes of data:
    Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
    Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
    Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
    Reply from 192.168.1.1: bytes=32 time=2ms TTL=64

    Pinging 10.4.0.1 with 32 bytes of data:
    Reply from 10.4.0.1: bytes=32 time=15ms TTL=254
    Reply from 10.4.0.1: bytes=32 time=9ms TTL=254
    Reply from 10.4.0.1: bytes=32 time=20ms TTL=254
    Reply from 10.4.0.1: bytes=32 time=7ms TTL=254

    Shouldn't the TTL field in the ping show me a value of 255 minus the number of hops (at least in Windows default settings)?4

    The second question concerns the interpretation of times in tracert. I came across a CCNA article http://www.freeccnaworkbook.com/blog/ccna/ping-vs-traceroute-vs-pathping in which the author argues that the 3-time measurement is not to check the delay 3 times, but to check the delays of 3 different paths with the same number of hops (?)

    "The intended purpose of the 3 probe count is to determine if the traffic traverses multiple routed paths due to route engineering, not to determine the latency 3 times."

    Can you verify it somehow?
  • ADVERTISEMENT
  • #2 12932978
    hermes-80
    Level 43  
    These are return packets set by the device that responds to your ping (ICMP protocol) - your packets (pings) die when they reach the device.

    Another thing is that intermediary devices can impose their values.
  • #3 12933063
    ckeddi1
    Level 10  
    You're right, I did a short test with suspicion in wireshark of the results. For simplicity, I made 1 Echo packet each and changed the default TTL value, as you can see in the picture.
    The conclusion is that no matter what TTL value I send (as long as it is not too small for the packet to reach), what counts is what value the responding host will send and the TTL displayed in the ping response is the TTL value minus the number of hops, right?

    Pinging wp.pl [212.77.100.101] with 32 bytes of data:
    Reply from 212.77.100.101: bytes=32 time=23ms TTL=245

    ping wp.pl -n 1 -i 255

    Pinging wp.pl [212.77.100.101] with 32 bytes of data:
    Reply from 212.77.100.101: bytes=32 time=28ms TTL=245

    ping 192.168.1.1 -n 1 -i 255
    Explanation of strange TTL ping field values and tracert times

    There is still a second question left :)
ADVERTISEMENT