What is TTL?

Time to Live (TTL) is a field in an IP packet header limiting how many router hops a packet may traverse before it is discarded, stopping packets from looping forever on an unstable or misconfigured network. The same term also names the expiration timer on a cached record – most commonly a DNS response – after which the cache must refresh it.

Key takeaways

• TTL decrements by one at every router hop; at zero the packet is dropped.
• IPv6 renames the field Hop Limit but keeps the identical function.
• DNS resource records carry a separate TTL that controls resolver caching.
• Traceroute tools send probes with rising TTL values to map a path’s hops.
• Versa SD-WAN and security policy rules can match traffic on TTL value.

On this page: Why it matters · How it works · Types · TTL & Versa · FAQ

Why is TTL important?

Without a hop limit, a packet caught in a routing loop – a misconfigured route, a transient BGP flap, a broken failover path – would circulate indefinitely, consuming bandwidth and router CPU. TTL guarantees every packet has a finite lifetime: no matter how bad the routing state gets, stray packets self-destruct within a bounded number of hops instead of accumulating forever.

TTL is also a working diagnostic. ping and traceroute read the TTL value in replies to infer distance and detect routing problems, which is why TTL values appear constantly in troubleshooting output, including SASE client connectivity checks. The same expiration concept, applied to DNS caching, controls a tradeoff every operator faces: a short TTL lets resolvers pick up changes quickly but increases authoritative-server queries; a long TTL reduces that load but delays how fast a DNS change propagates.

What is TTL?

In the IPv4 header, TTL is an 8-bit field set by the sending host – commonly 64, 128, or 255 depending on the operating system – and decremented by one at every router that forwards the packet. When a router would decrement TTL to zero, it discards the packet and, in most implementations, returns an ICMP “Time Exceeded” message to the sender. This single rule keeps undeliverable packets from persisting past a bounded number of hops.

The same idea applies to cached data. A DNS resource record ships with its own TTL, in seconds, set by the authoritative name server. A resolver serves the cached answer until that TTL expires, then re-queries for a fresh value – decoupling clients from the cost of a full lookup on each request while still bounding how stale an answer can get.

Types of TTL

IPv4 TTL is the original 8-bit hop-count field defined for the Internet Protocol. IPv6 Hop Limit is the same mechanism under a new name in the IPv6 header – an 8-bit field decremented per hop with identical semantics, renamed because “time to live” no longer refers to any wall-clock timer.

DNS TTL is unrelated to hop counting: a per-record cache-expiration timer set by the zone owner, independent per resource-record set, so an MX record and an A record for the same name can carry different TTLs. TTL Security (GTSM), used mainly with BGP, rejects any incoming packet whose TTL is not near the maximum – since a directly connected peer’s packets barely decrement, this filters out spoofed packets that could only have originated many hops away, without full authentication.

TTL & Versa

VOS security-access and SD-WAN policy rules can match traffic on the packet’s TTL value. On the Headers/Schedule tab of an SD-WAN policy rule, a TTL condition – equal to, greater than or equal to, or less than or equal to a value from 1–255 – combines with IP version, IP flags, and DSCP to select which packets the rule applies to. Service chain rules expose the same TTL condition and value fields, so traffic can be steered into a service chain based partly on how many hops it has already traveled.

TTL also surfaces in day-to-day troubleshooting. SASE client connectivity checks rely on ping and route print output, and every reply line reports the responding host’s TTL – a quick signal, alongside round-trip time and packet loss, for confirming traffic reaches the expected destination.

Frequently asked questions

What is the difference between TTL and IPv6 Hop Limit?

They are the same mechanism under different names. IPv4 calls the field TTL and IPv6 calls it Hop Limit, but both are 8-bit counters decremented at every router hop, and both cause the packet to be discarded once the count reaches zero.

Why does a DNS record have its own TTL?

A DNS TTL is a cache-expiration timer, not a hop count. It tells resolvers how long to serve a cached answer before re-querying the authoritative server, balancing propagation speed against query load on that server.

How does traceroute use TTL?

Traceroute sends successive probes with TTL set to 1, then 2, then 3, and so on. Each router that discards an expired probe replies with an ICMP Time Exceeded message, revealing that hop’s address one hop at a time.

What happens to a packet when its TTL reaches zero?

The router that would decrement TTL to zero discards the packet instead of forwarding it, and typically returns an ICMP Time Exceeded message to the sender. This stops packets looping indefinitely on a broken or unstable route.

What TTL value do operating systems typically send?

Common defaults are 64 (Linux and most Unix-like systems), 128 (Windows), and 255 (many network appliances). Because TTL decrements per hop, the value observed at the destination hints at how many routers a packet crossed.

More on TTL

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about TTL, these are worth looking at next.