IDENTIFY OS FROM TTL (TIME TO LIVE) VALUE

Do you know that it can be determined from TTL response that the responding device is using which operating system?

 

TTL means Time to Live in IPv4, and Hop Limit in IPv6, is a component of Ping command. Ping command operates by sending Internet Control Message Protocol (ICMP) Echo Request packets to the target host and waiting for a reply. While pinging any server from you will get response with certain values where TTL is also shown. TTL is number of hops of a packet travels before getting discarded. TTL travers through many routers to reach to respond to origin. Each router it passes, reduces TTL count by 1 when a packet passes through it. You can see in the below illustration. 

Different operating systems responds with different value.

  • Unix / Linux – 64
  • Windows – 128,
  • Solaris/AIX – 265

 Let’s test this with Linux.org. If you ping linux.org you will get TTL=56 then if you tracert linux.org you will get 8 hops. To identify responding operating system, you need to sum total of TTL and Hops, i.e. TTL = 56 + Hops = 8 which totals 64. Unix / Linux server responds 64.

 


If you ping your company’s server or domain name, you will get response accordingly. Add number of hops to TTL response to get the value. If you get other than 64, 128 or 256, check the closest number to these and that will be the operating system / platform of the device.


Comments

Popular posts from this blog

WHAT IS RAID?

IMPORTANCE OF CPU SPEED OR PROCESSOR SPEED AND MEMORY

WHAT IS ORCHESTRATION?