why ttl in ping request packet and ping response not the same

[aaronchan3138]

I have two win7 PCs:

        pc1 is 10.10.10.2 

        pc2 is 10.10.10.3

when I execute "ping 10.10.10.3" from 10.10.10.2,using wireshark to check the ttl value in the ping request packet,the ttl is 64;

however when I execute "ping 10.10.10.2" from 10.10.10.3,the ttl value in the ping response packet is 128.

so the "TTL" value on the same server can be different in ping request packet and response packet?

how to modify the "request" and "response" ttl?

[pieterh]

yes you can specify the TTL

the TTL in the packet is decremented by a router after each "hop" (router traversal)

So you can limit how "far" you want the packet to travel.

a similar mechanism is used in the command traceroute this performs something like multiple ping's with incrementing TTL.

and at each response report router was reached.

you need option  ping -i <count> to specify Time To Live.

on a windows system use ping /? to see the all options you can add to your command

>ping /?

Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
            [-r count] [-s count] [[-j host-list] | [-k host-list]]
            [-w timeout] [-R] [-S srcaddr] [-c compartment] [-p]
            [-4] [-6] target_name

Options:
    -t             Ping the specified host until stopped.
                   To see statistics and continue - type Control-Break;
                   To stop - type Control-C.
    -a             Resolve addresses to hostnames.
    -n count       Number of echo requests to send.
    -l size        Send buffer size.
    -f             Set Don't Fragment flag in packet (IPv4-only).
    -i TTL         Time To Live.
    -v TOS         Type Of Service (IPv4-only. This setting has been deprecated
                   and has no effect on the type of service field in the IP
                   Header).
    -r count       Record route for count hops (IPv4-only).
    -s count       Timestamp for count hops (IPv4-only).
    -j host-list   Loose source route along host-list (IPv4-only).
    -k host-list   Strict source route along host-list (IPv4-only).
    -w timeout     Timeout in milliseconds to wait for each reply.
    -R             Use routing header to test reverse route also (IPv6-only).
                   Per RFC 5095 the use of this routing header has been
                   deprecated. Some systems may drop echo requests if
                   this header is used.
    -S srcaddr     Source address to use.
    -c compartment Routing compartment identifier.
    -p             Ping a Hyper-V Network Virtualization provider address.
    -4             Force using IPv4.
    -6             Force using IPv6.

C:\Users\hartpat>

[aaronchan3138]

I know how TTL works , what confuses me is that on the same machine,when it sends a icmp request,the ttl in its packet is 64,however when it sends a icmp reply,the ttl in its packet is 128. 

[Giuseppe Larosa]

Hello Aaron,

I think that the ICMP echo-reply uses the TTL value in the ICMP echo message.

The ICMP echo sender uses a default TTL value that is operating system type depending can be 64, or 128 or 255. The responder uses the TTL value seen in the ICMP echo recieved.

This should explain what you see.

Hope to help

Giuseppe

[aaronchan3138]

I use wireshark to capture some packets,it looks like the "reply" side doesn't always use the ttl in "request" side.

1) 10.82.12.211 uses ttl=64 when it sends icmp request message(many articles say win7 have default ttl=128,but here it uses 64).

2) 10.82.13.208 uses ttl=128,not the 64 in ICMP request message.

Now,Lets turn it over:

1) 10.82.13.208 uses ttl=64 when it sends ICMP request message.it is different from 128 when it sends ICMP reply message.

2)10.82.12.211 uses ttl=64,it looks same as it sends ICMP request message.

It looks like there is no fixed rule...

[pieterh]

both are windows-7 PC's ? -> so it is not really a very different TCP-stack

but could you verify both have same build/patches/windows version (home vs pro or ultimate?)

[aaronchan3138]

both are win7 but with different service pack.

is there any way to check the default TTL settings on a PC?

[pieterh]

that question is better asked in a windows forum :-( 

but it is definitively OS and version dependent

TTL values are different for different Operating Systems....... You can get the TTL value by pinging an address.

Windows	NT 4.0 SP5-		32
Windows	NT 4.0 SP6+		128

Windows	7	ICMP/TCP/UDP	128

[aaronchan3138]

After searching google for long time,I got some details about TTL settings in IP segment: it seems that different OS have seperate default TTL settings for ICMP REQUEST and ICMP REPLY. Thank u all the same!