IDENTIFY OS FROM TTL (TIME TO LIVE) VALUE
Do you know that it can be determined from TTL
response that the responding device is using which operating system?
TTL means Time to Live in IPv4, and Hop Limit in IPv6, is a component of Ping command. Ping command operates by sending Internet Control Message Protocol (ICMP) Echo Request packets to the target host and waiting for a reply. While pinging any server from you will get response with certain values where TTL is also shown. TTL is number of hops of a packet travels before getting discarded. TTL travers through many routers to reach to respond to origin. Each router it passes, reduces TTL count by 1 when a packet passes through it. You can see in the below illustration.
Different operating systems responds with
different value.
- Unix / Linux – 64
- Windows – 128,
- Solaris/AIX – 265
Let’s test this with Linux.org. If you ping linux.org you will get TTL=56 then if you tracert linux.org you will get 8 hops. To identify responding operating system, you need to sum total of TTL and Hops, i.e. TTL = 56 + Hops = 8 which totals 64. Unix / Linux server responds 64.


Comments
Post a Comment