What is TTL (Time to Live)?

TTL (Time to Live) is an 8-bit field in an IP packet header that limits the lifetime of a packet to prevent it from circulating indefinitely in routing loops. Each time a router forwards the packet, it decrements the TTL by 1. When TTL reaches 0, the router discards the packet and sends an ICMP "Time Exceeded" message back to the source. The initial TTL value varies by OS: typically 64 for Linux/macOS and 128 for Windows. By examining the TTL of received packets, you can sometimes guess the OS of the sending device. Traceroute exploits TTL by sending packets with TTL=1, 2, 3... each intermediate router discards the packet when TTL hits 0 and sends a Time Exceeded response, revealing that router's IP. In DNS, TTL controls how long a record is cached — a short TTL means faster propagation of changes but more DNS lookups.