What Is TTL? Reading Ping, Traceroute and DNS Values

A ping reply showing TTL=55 and a DNS record showing TTL=300 are not measuring the same thing. IP TTL constrains packet forwarding; DNS TTL describes cache lifetime. Reading one as the other leads to misleading network diagnoses.

The forwarding limit in an IP header

IPv4 TTL is an eight-bit field. A router reduces it by at least one when forwarding; a packet whose limit is exhausted is not forwarded. This bounds the life of a packet caught in a routing loop. It does not tell the packet which route to take, and it is not a count of how many routers remain before the destination. See the IPv4 router requirements.

IPv6 calls the corresponding field Hop Limit, decremented by one by each forwarding node. Treat it as a forwarding limit, not a DNS-style number of seconds. The IPv6 specification defines the field.

What a received TTL can actually tell you

This illustrative IPv4 reply is explanatory text, not output from a test performed for this article:

Reply from 192.0.2.10: bytes=32 time=24ms TTL=55

The remaining value belongs to the reply that arrived. Subtracting it from 64 assumes an initial value you may not know. Even when the initial value is known, you are examining the returning packet, not necessarily the route taken by your request. Paths can differ by direction, and initial values are configurable. A single TTL is therefore not reliable proof of a remote operating system.

For a short test, use ping -n 4 on Windows or ping -c 4 on Linux/macOS followed by a destination you are allowed to test. IPv6 output may look different. Changing your machine's global outgoing TTL does not change the initial TTL chosen by the remote host for its replies.

Why traceroute starts with small values

Traceroute sends new probes with progressively larger initial limits. Forwarding routers decrement each probe's limit; expiry responses, when returned, reveal intermediate points. The tool does not modify one already travelling packet to extend its journey. Microsoft's TRACERT troubleshooting guide explains this discovery process.

An asterisk means no response arrived within the wait period, not that every application packet is being dropped there. Filtering and response limits can hide hops. Reported timings include the response path, so subtracting adjacent rows does not reliably measure a single physical link's delay.

The separate meaning in DNS

A DNS resource record's TTL expresses cache lifetime in seconds. A value of 300 represents five minutes, not 300 forwarding hops. Lowering the authoritative TTL does not retroactively shorten the lifetime of copies already cached under an older value. The resource-record definition is in RFC 1035.

Before a DNS migration, shorter cache lifetimes can help newly cached answers expire sooner; they do not shorten an IP route. If a changed record is not visible, compare the resolver's answer with the authoritative answer using DNS lookup tools. The TTL printed by ping is not the field to adjust.