Okay, I'm much clearer on this now. So in reality, the IP TTL
doesn't really measure anything anymore, we just need to make sure our
routers decrement it so that a box getting an IP packet with 0 will
discard it any not let it float around the networka aimlessly.
Thanks for the help. Much appreciated!
Tim
On 11 Apr 2002 13:54:41 -0400, [EMAIL PROTECTED] ("Priscilla
Oppenheimer") wrote:
>Timoue (timeout!? ;-)
>
>IP TTL is a reverse hop count. The sender sets it to some large number like
>255 or 64 or 32 (depending on the OS). Each router decrements it by one. If
>that causes the TTL to become zero, then the packet is dead. The router
>discards it. The goal is to stop a packet from travelling around an
>internetwork forever, which could happen if there were a routing loop.
>
>Originally, the IP designers also envisioned that the TTL could be a rough
>measurement of time. A router could decrement the TTL by more than one if
>it took more than one second to handle the frame. The router could
>decrement the TTL by the number of seconds it took to work on the frame.
>These days if a router took more than a second to forward a frame, you
>would pull the plug and use it as a boat anchor.
>
>Some protocol analyzers still show the TTL value as hops/seconds. I think
>the Sniffer still does this. It's misleading for two reasons. No routers
>use seconds anymore, and the hops/seconds makes it look like a ratio. Ugh.
>
>One more comment, you were worried about 15,000 milliseconds. Remember
>that's only 15 seconds. So if the TTL were measured in seconds, 255 would
>be much bigger.
>
>By the way, my ping using 3600 seconds on my Albany router (see my previous
>reply) is still sitting there!
>
>Priscilla
>
>
>At 02:58 AM 4/11/02, [EMAIL PROTECTED] (Timothy Ouellette) wrote:
>>Okay, so ICMP doens't specify a TTL on it's own. Doesn't IP by itself
>>have a TTL of 255?
>>
>>Maybe i'm missing something.
>>
>>Tim
>>
>>On 11 Apr 2002 01:26:56 -0400, [EMAIL PROTECTED] ("Joseph
>>Ezerski") wrote:
>>
>> >Ok, according to Stevens (TCP/IP Illustrated Vol 1), the ICMP Ping Packet
>> >looks like this:
>> >
>> >
>> > 0 1 2 3
>> > 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
>> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>> > | Type | Code | Checksum |
>> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>> > | Identifier | Sequence Number |
>> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>> > | Optional Data |
>> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
>> >
>> >The RFC 792, does not specify a time value, other than IP TTL (at that
>time,
>> >assumed to be in units of seconds). I think it really depends on how
your
>> >OS has implemented it. For example, on my Windows PC, the default
timeout
>> >is 2000ms. However, there is an option you can set (-w in the windows
>> >world) to extend that timeout. Stevens mentions something about newer
>UNIX
>> >implementations (as of the early 90s) timing out after 20 seconds. My
>> >Solaris box times out after 20 s, and it is listed in the man pages as
>such.
>> >
>> >HTH
>> >
>> >-Joe
>> >
>> >
>> >
>> >-----Original Message-----
>> >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
>> >Ouellette, Tim
>> >Sent: Wednesday, April 10, 2002 8:13 PM
>> >To: '[EMAIL PROTECTED]'; '[EMAIL PROTECTED]'
>> >Subject: Ping times? Am i missing something
>> >
>> >
>> >The other day while troubleshooting an issue, I saw some pings from out
>> >Tivoli Netview box and it was showing ping times in the 15,000+ ms range.
>Is
>> >this possible? I though there was a limit on this particular field in the
>> >head. If an of our frame-format experts (Priscilla?) or sniffer gurus
>> >(again... Priscilla?), could point me someone I'd appreciate it. Thanks
a
>> >bunch!
>> >_________________________________________________________________
>> >Commercial lab list: http://www.groupstudy.com/list/commercial.html
>> >Please discuss commercial lab solutions on this list.
>________________________
>
>Priscilla Oppenheimer
>http://www.priscilla.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=41242&t=41151
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
