TTL in ping stands for Time to Live, and it tells you how many network hops a packet can still make before it expires. When you run a ping command and see a line like TTL=118, that number represents how much “life” the reply packet had left when it reached you. It’s one of the most useful clues ping gives you about the path between your computer and a remote server.
How TTL Works
Every data packet sent over the internet carries a TTL value in its header. This value starts at a number set by the sending device’s operating system, and every router the packet passes through subtracts one before forwarding it along. If the TTL ever reaches zero, the router discards the packet instead of forwarding it and sends back an error message (“Time Exceeded”) to the sender.
This countdown exists to prevent a critical problem: packets getting stuck in infinite loops. If two or more routers have a misconfiguration and keep sending a packet back and forth between each other, the TTL ensures that packet will eventually die. Without it, looping packets would pile up, eat bandwidth, and destabilize the network. A packet can never be forwarded more than 254 times, so the loop always has a hard limit.
Default TTL Values by Operating System
The starting TTL value depends on which operating system sent the reply packet:
- Linux and macOS: 64
- Windows: 128
- Network devices (routers): 255
This matters because the TTL you see in a ping reply is not the starting value. It’s the starting value minus the number of hops the packet took to reach you. So if you ping a server and see TTL=52, the reply likely started at 64 (a Linux or macOS server) and crossed 12 routers on the way back to you. If you see TTL=118, the server is probably running Windows (starting at 128) and the packet crossed 10 hops.
Estimating Hop Count From TTL
You can estimate how many routers sit between you and a remote server with simple math. Find the nearest default starting value above the TTL you received, then subtract.
For example, if you ping google.com and get TTL=117, the closest default above 117 is 128 (Windows). That means the reply crossed roughly 11 routers. If you get TTL=55, the closest default is 64 (Linux/macOS), suggesting about 9 hops. This isn’t exact, since some networks use non-standard starting values, but it gives you a reliable ballpark.
A sudden change in TTL when pinging the same server can signal a routing change. If yesterday’s ping showed TTL=56 and today it shows TTL=49, the packets are now taking a longer path through seven additional routers. That kind of shift can help explain new latency or connection problems.
Setting a Custom TTL
You can manually control the TTL value when running ping. On Windows, use the /i flag:
ping /i 10 google.com
On Linux and macOS, use the -t flag:
ping -t 10 google.com
Setting a low TTL on purpose is useful for testing. If you set TTL to 5 and the destination is 12 hops away, the packet will expire at the fifth router, which will send back an error message identifying itself. This is actually the core technique behind the traceroute (or tracert) command. Traceroute sends packets with TTL set to 1, then 2, then 3, and so on. Each time, the packet expires one hop further along the path, and the router that discards it reports back. By collecting all those responses, traceroute maps the full route your traffic takes to reach a destination.
What Different TTL Values Tell You
A high TTL in your ping results (like 127 or 63) means the server is very close to you in network terms, perhaps just one hop away. This is common when pinging devices on your local network or servers in a nearby data center.
A low TTL (like 40 or below) means the packet crossed many routers, which is typical for servers on the other side of the world. By itself, a low TTL doesn’t mean anything is wrong. It simply reflects distance in network hops, not necessarily geographic distance. A packet might cross 15 routers to reach a server in the same country if the network path is complex.
A TTL of 1 in a reply is unusual and could mean the responding device is nearly at its hop limit. If you see “TTL expired in transit” as an error instead of a normal reply, the packet ran out of hops before reaching the destination. This can point to a routing loop somewhere along the path, or it might just mean your manually set TTL was too low for the distance.
TTL in IPv6
In the newer version of the internet protocol (IPv6), the TTL field was renamed to “Hop Limit.” The function is identical: each router subtracts one, and the packet is discarded when the value hits zero. The rename just makes the name more accurate, since TTL was always counted in hops rather than actual time. If you see “hlim” or “hop limit” in IPv6 ping results, it means the same thing as TTL in IPv4.