TTL: why packets cannot drive around forever

Imagine driving onto the Packet Highway. You have a destination, a full tank, and a navigation system that confidently announces: “Turn right in three hundred metres.” You turn. A moment later, it says exactly the same thing. And again.

After the fourth turn, you recognise the petrol station where you bought a hot dog five minutes ago. After the fifth, you see the same loan advertisement. After the sixth, you begin to suspect the navigation system works for the petrol station owner.

In the real world, you could continue until you ran out of fuel, patience, or money. On the Internet, that would be a serious problem: a packet could circulate between routers, consuming bandwidth and network resources.

So someone sensible said: “Right, everyone. Every car gets a limited number of crossings. Once those are used up, the trip is over.” And that brings us to TTL.

A ticket for a limited number of crossings

TTL stands for Time To Live. The name makes it sound like a stopwatch counting seconds. In modern IPv4 networks, though, it works primarily as a router hop counter. Each router forwarding the packet reduces its value by one.

Imagine a car entering the highway with a ticket marked TTL = 5.

At the first router: “Five crossings? Stamp one. Four left.” At the second: “Four? Three left.” At the third: “Three? Two left.” At the fourth: “Two? One left.” At the fifth: “One? I'm afraid you're not going any further.”

— But I have a destination address!
— Congratulations. You can have it framed.

🤣 A router drops a packet when decrementing TTL for forwarding exhausts the counter. It doesn't guess how close the destination might be. It doesn't extend the ticket. It doesn't call an administrator to request a special exception.

Important: TTL is reduced by routers that forward packets, not by every Ethernet switch or ordinary Wi-Fi access point. And a packet arriving at its final destination does not need to be forwarded through another router — the limit applies to forwarding.

Who issues the tickets?

The sender's operating system usually chooses the initial TTL. Common starting values include 64, 128, and 255. These are popular defaults, not mandatory values for every device.

Routers along the way don't issue fresh tickets: they receive a packet and decrement its counter. So a driver cannot pull up to a toll booth and announce:

— I've got seven crossings left, but I'd like another sixty-four.
— Who issued your paperwork?
— Windows.
— Then please take it up with Windows.

When two routers agree it's the other one's fault

In our routing story, we learned about the routing tables used to send packets towards their destination. Usually that works beautifully. Occasionally, however, the configuration becomes a little… creative.

Router A: “That network? Go through B.”
Router B: “That network? Obviously through A.”
Router A: “B.”
Router B: “A.”
Router A: “B.”

The packet passes the same checkpoint once more.

— Haven't you been here already?
— Yes, but that other router told me to come back.
— Why did you come back?
— Because you told me to go to the other router!
— Ah. Then everything is proceeding according to procedure.

That's a routing loop. TTL doesn't repair it, fix the routing tables, or decide which administrator made the mistake. It does ensure that the same packet cannot loop forever.

A ticket from the router: ICMP Time Exceeded

When TTL expires in transit, a router can notify the sender with an ICMP Time Exceeded message. In IPv4, that's ICMP type 11, code 0 — time to live exceeded in transit.

Dear Sir or Madam,
We regret to inform you that your shipment did not reach its destination because its permitted number of crossings has been exhausted. It was last seen at our junction.
Yours faithfully,
Packet Highway Authority

But the absence of a notice doesn't mean the packet wasn't dropped. ICMP replies may be rate-limited or filtered. The car might have been stopped; the clerk simply didn't send the letter. Perhaps the office ran out of paper. Perhaps the printer broke. Perhaps it's Friday.

And IPv6? The inspector got a better name

IPv6 has a very similar mechanism, but calls it Hop Limit instead of TTL. Each forwarding router decrements the value, and when the limit is exhausted, the packet is dropped. The router can also return an ICMPv6 Time Exceeded message.

IPv4: “Your time to live has expired.”
IPv6: “You've used up all your hops.”
IPv4: “Mine sounds more serious.”
IPv6: “At least mine says what it means.”

An administrator discovers the art of collecting fines

One administrator notices that routers can report where a packet's allowance ran out. An idea forms: “What if I deliberately sent cars with increasingly short tickets?”

First comes a probe with TTL = 1. The first router stops it and may reply: “Here!” Then comes TTL = 2 — the second router replies. Next TTL = 3, TTL = 4… The successive notices help reveal the path.

That's the basic idea behind traceroute. Real implementations use different kinds of probes, some responses never arrive, and successive probes may not take identical routes. But the idea is magnificent: send cars out specifically to collect traffic tickets.

Some people call it wasteful. Administrators call it diagnostics.

Is TTL a security feature?

Yes, but only in a specific sense. TTL and Hop Limit prevent individual packets from circulating indefinitely. They aren't encryption, authentication, or a firewall. Nor do they repair the broken routes that caused the loop.

Yet they're incredibly useful. In a world of complex protocols and documentation thicker than a power station manual, sometimes all you need is a number that each router reduces by one.

Finally: another lap around the roundabout

Our driver is still looking for the exit.

— Officer! I was only trying to get to Katowice!
— TTL zero. End of the road.
— But I have GPS!
— I can see that. That's why we've met seven times already.
— Then how do I find out where I took the wrong turn?
— Ah, sir. That's a job for traceroute.

Next time, an administrator sends a whole convoy onto the highway solely to find out which checkpoints issue the fines. The inspectors are delighted. The drivers, rather less so. 🤣