Windows 7 using different TTL Value's for Ping & Traceroute

[sethpuneet4]

Hi,

I'm a bit amazed to see my machine using different TTL Value's for Ping & Traceroute to the same destination 4.2.2.2.

C:\Users>tracert 4.2.2.2

Tracing route to vnsc-bak.sys.gtei.net [4.2.2.2]
over a maximum of 30 hops:

1 <1 ms 1 ms 2 ms X.X.X.X
2 36 ms 36 ms 37 ms X.X.X.X
3 35 ms 35 ms 37 ms X.X.X.X
4 40 ms 39 ms 36 ms X.X.X.X
5 42 ms 42 ms 41 ms X.X.X.X
6 42 ms 36 ms 41 ms X.X.X.X
7 42 ms 42 ms 41 ms X.X.X.X
8 49 ms 51 ms 77 ms X.X.X.X
9 70 ms 77 ms 106 ms X.X.X.X
10 111 ms 100 ms 109 ms X.X.X.X
11 39 ms 39 ms 45 ms X.X.X.X
12 37 ms 36 ms 38 ms X.X.X.X
13 67 ms 74 ms 54 ms X.X.X.X
14 103 ms 132 ms 131 ms X.X.X.X
15 337 ms 344 ms 334 ms X.X.X.X
16 363 ms 385 ms 356 ms X.X.X.X
17 341 ms 387 ms 392 ms X.X.X.X
18 322 ms 337 ms 373 ms vnsc-bak.sys.gtei.net [4.2.2.2]

We can see here My machine sending the packet with TTL 18 as it was failing till TTL 17.

But then the reply we get is with TTL 46.

1770 2012-05-30 13:09:19.341600 10.76.212.161 4.2.2.2 ICMP 106 Echo (ping) request id=0x0001, seq=9808/20518, ttl=18
Internet Protocol Version 4, Src: 10.76.212.161 (10.76.212.161), Dst: 4.2.2.2 (4.2.2.2)
Time to live: 18

1777 2012-05-30 13:09:19.664439 4.2.2.2 10.76.212.161 ICMP 106 Echo (ping) reply id=0x0001, seq=9808/20518, ttl=46
Internet Protocol Version 4, Src: 4.2.2.2 (4.2.2.2), Dst: 10.76.212.161 (10.76.212.161)
Time to live: 46

I know that Windows 7 by default uses TTL of 128.

Then why does the reply is not showing me the TTL as 110 (128-18).

Here is the output if i ping the same destination

C:\Users\cisco>ping 4.2.2.2

Pinging 4.2.2.2 with 32 bytes of data:
Reply from 4.2.2.2: bytes=32 time=353ms TTL=46

Even in the Reply i get the TTL of 46 back on my client.

But in the capture on my Nic card this is what i see

2105 2012-05-30 13:09:25.464376 10.76.212.161 4.2.2.2 ICMP 74 Echo (ping) request id=0x0001, seq=9811/21286, ttl=128

And in the reply i see the TTL of 46 Again (in this case should it not show me 110 again).

2130 2012-05-30 13:09:25.780548 4.2.2.2 10.76.212.161 ICMP 74 Echo (ping) reply id=0x0001, seq=9811/21286, ttl=46

Where is this discrepancy.


Puneet

 

[logicearth]

Do you have a specific question...or are you just over analyzing things and assuming their is a problem?