What is TTL?
Time To Live
TTL (Time To Live) is an IPv4 header field that each router decreases by one; at zero the packet is dropped, so packets can't loop forever.
The sender picks a starting value of up to 255. Common defaults are 64 on Linux and macOS and 128 on Windows. Each router that forwards the packet decrements it, and a router that decrements it to zero discards the packet and normally sends an ICMP Time Exceeded message back to the source. IPv6 has the same field under a more honest name, Hop Limit: despite the name, the value counts hops, not seconds. Without it, a routing loop would keep packets circulating until links filled up; with it, a loop wastes at most a limited number of hops per packet.
traceroute is built on TTL: it sends probes with TTL 1, 2, 3 and so on, and each router that drops one reveals itself in its Time Exceeded reply. TTL also matters for routing protocols. eBGP sends with TTL 1 by default, so a session to a neighbour's loopback, which is not on the shared link, needs ebgp-multihop or a disabled connected check. GTSM turns this around as a security measure: peers send with TTL 255 and only accept packets that arrive with a TTL of 255 (or within the few hops configured), which a remote attacker several hops away can't fake. A routing loop shows up in traceroute as the same few routers repeating until the TTL runs out. Don't confuse IP TTL with the DNS TTL, which is how many seconds a resolver may cache a record. The Linux Network Connectivity lesson uses traceroute to follow a path, and BGP on loopbacks shows what the TTL of 1 means for eBGP.
Lessons that use TTL
- Debugging BGP: every session state, reproducedIntermediate · 60 min
Break a working BGP lab a dozen ways and learn to read each failure: Idle, Connect, Active and OpenSent, max-prefix, firewalls, wrong AS, TTL, hold timers, missing policy and unreachable next hops, all with real FRR output and packet captures.
- Linux Network ConnectivityBeginner · 80 min
Find out why a Linux machine can't reach something, layer by layer: interfaces and addresses, routes and ip route get, ARP and the neighbour table, ping and traceroute, DNS, and listening sockets — with real output from a three-host lab.
- BGP on loopbacks vs interface addressesIntermediate · 45 min
Why BGP sessions between loopbacks survive link failures and use parallel links, and what they need to work: an IGP or static routes, update-source, the eBGP connected check, and BFD. Every failure is reproduced on two real VyOS routers.
- BGP FundamentalsIntermediate · 75 min
How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.
- Setting up VyOS with basic BGPIntermediate · 50 min
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.