 | 1 | initial version |
The ip.ttl is telling you a couple things. 1) After 125 more hops the packet will be discarded. 2) It could be telling you which device is actually sending that packet. Windows devices start with one TTL and Cisco devices, for example, will start with a different TTL. If you are seeing packets on the same network from the same IP but different TTL's, this would tell you that another device is "standing in" for the IP.
| | 2 | No.2 Revision |
The ip.ttl is telling you a couple things. 1) After 125 more hops the packet will be discarded. 2) It could be telling you which device is actually sending that packet. Windows devices start with one TTL and Cisco devices, for example, will start with a different TTL. If you are seeing packets on the same network from the same IP but different TTL's, this would tell you that another device is "standing in" for the IP. Compare the TTL's of send packets with the same IP's. If you see a different TTL, this would indicate two different devices.
