Ask Your Question

Which TCP field would indicate that a routing loop has occurred in a network?

asked 2022-03-27 22:30:58 +0000

tlm gravatar image

Which TCP field would indicate that a routing loop has occurred in a network?

edit retag flag offensive close merge delete


Is this true? How can I view the TTL With a wireshark filter so see value of 0? Is it The TTL ( Time to live) field in TCP which is of 8-bit. Each packet that you sent will have value of this TTL field from 0-255 and when the value become zero, we consider a loop has occurred and we drop the packet.

tlm gravatar imagetlm ( 2022-03-27 22:45:28 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2022-03-28 07:30:05 +0000

BigFatCat gravatar image

updated 2022-03-28 07:41:30 +0000

The TTL is an IPv4 field. The hop count field is used in IPv6. The hop count is not tracked by TCP. If Wireshark thinks a packet is a duplicate, it will warn you. The Wireshark field for TTL is ip.ttl. You can try the display filter for ip.ttl==0, but don't be surprise if there aren't any matches. Before a packet is forwarded at layer 3, the TTL or hop count is decremented by 1. If result is zero, then the packet is discarded and the source IP is notified that the time exceeded (IPv4) or hop count exceeded (IPv6). Capture the "exceeded" packet, and it will show the source of the message.

A routing loop, low initial TTL, or non-optimal route can cause a TTL/hop count to exceed. What could be more helpful looking for a layer 3 loop is a traceroute. You will be looking for the repeat of the same addresses in the traceroute.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-03-27 22:30:58 +0000

Seen: 492 times

Last updated: Mar 28 '22