LightAtom

What Is TTL in Networking?

TTL means two different things: a hop counter that stops packets looping forever, and the time a DNS answer may be cached.

TTL (time to live) limits how long data lives. On IP packets it's a hop count: every router subtracts one, and at zero the packet is dropped. On DNS records it's a number of seconds that resolvers and devices may cache the answer before looking it up again.

How it works

An IP packet leaves with TTL 64, each router lowers it, and at 0 it is dropped with an ICMP message. A DNS record with TTL 300 is cached for 5 minutes, then looked up again.

IP packet TTL (hop limit)

Every IP packet carries a TTL field (called hop limit in IPv6). Each router decrements it; a router that takes it to zero discards the packet and sends back an ICMP Time Exceeded message (“TTL expired in transit” on Windows). This stops routing loops from circulating packets forever.

Operating systems start at different values: 64 for macOS, iOS and Linux, 128 for Windows, 255 for many routers. That's why a ping reply's TTL hints at how far away a host is and what it runs: a reply with TTL 57 from a Linux server started at 64 and crossed 7 routers.

Traceroute exploits this: it sends packets with TTL 1, 2, 3… and records which router returns each Time Exceeded message.

DNS TTL (cache lifetime)

Each DNS record has a TTL in seconds. Resolvers cache the answer for that long. Typical values are 300 seconds (5 minutes) to 86,400 (a day). Low TTLs let changes spread quickly; high TTLs mean fewer lookups. Before moving a site, lower the TTL a day ahead so the switch propagates fast.

Examples

$ ping -c1 1.1.1.1
64 bytes from 1.1.1.1: icmp_seq=0 ttl=57 time=12.3 ms
$ dig apple.com A +noall +answer
apple.com.   2340   IN   A   17.253.144.10

The second column of dig's answer is the remaining cache time in seconds.

On a Mac

  • ping -m 5 host sets the outgoing TTL (on macOS, -t is a timeout, not the TTL).
  • sysctl net.inet.ip.ttl shows the default: 64.
  • dig shows DNS TTLs; asking the same resolver twice shows the number counting down.

See it in the app

LightAtom's traceroute sends probes with increasing TTL to map each router between your Mac and a server.

Frequently asked questions

What does TTL mean in ping?

It's the remaining hop count of the reply packet. It started at the sender's default (64, 128 or 255) and dropped by one per router.

What is a good DNS TTL?

300 to 3,600 seconds suits most records. Use lower values before planned changes, higher values for records that rarely change.

What does “TTL expired in transit” mean?

A packet ran out of hops before reaching its destination, usually because of a routing loop, or because traceroute set a low TTL on purpose.

What is the default TTL on a Mac?

64, the same as Linux and iOS. Windows uses 128.

LightAtom team

The people who build LightAtom, a network monitor for macOS.