Timoue (timeout!? ;-)
IP TTL is a reverse hop count. The sender sets it to some large number like
255 or 64 or 32 (depending on the OS). Each router decrements it by one. If
that causes the TTL to become zero, then the packet is dead. The router
discards it. The goal is to stop a packet from travelling around an
internetwork forever, which could happen if there were a routing loop.
Originally, the IP designers also envisioned that the TTL could be a rough
measurement of time. A router could decrement the TTL by more than one if
it took more than one second to handle the frame. The router could
decrement the TTL by the number of seconds it took to work on the frame.
These days if a router took more than a second to forward a frame, you
would pull the plug and use it as a boat anchor.
Some protocol analyzers still show the TTL value as hops/seconds. I think
the Sniffer still does this. It's misleading for two reasons. No routers
use seconds anymore, and the hops/seconds makes it look like a ratio. Ugh.
One more comment, you were worried about 15,000 milliseconds. Remember
that's only 15 seconds. So if the TTL were measured in seconds, 255 would
be much bigger.
By the way, my ping using 3600 seconds on my Albany router (see my previous
reply) is still sitting there!
Priscilla
At 02:58 AM 4/11/02, [EMAIL PROTECTED] (Timothy Ouellette) wrote:
>Okay, so ICMP doens't specify a TTL on it's own. Doesn't IP by itself
>have a TTL of 255?
>
>Maybe i'm missing something.
>
>Tim
>
>On 11 Apr 2002 01:26:56 -0400, [EMAIL PROTECTED] ("Joseph
>Ezerski") wrote:
>
> >Ok, according to Stevens (TCP/IP Illustrated Vol 1), the ICMP Ping Packet
> >looks like this:
> >
> >
> > 0 1 2 3
> > 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > | Type | Code | Checksum |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > | Identifier | Sequence Number |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> > | Optional Data |
> > +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
> >
> >The RFC 792, does not specify a time value, other than IP TTL (at that
time,
> >assumed to be in units of seconds). I think it really depends on how your
> >OS has implemented it. For example, on my Windows PC, the default timeout
> >is 2000ms. However, there is an option you can set (-w in the windows
> >world) to extend that timeout. Stevens mentions something about newer
UNIX
> >implementations (as of the early 90s) timing out after 20 seconds. My
> >Solaris box times out after 20 s, and it is listed in the man pages as
such.
> >
> >HTH
> >
> >-Joe
> >
> >
> >
> >-----Original Message-----
> >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
> >Ouellette, Tim
> >Sent: Wednesday, April 10, 2002 8:13 PM
> >To: '[EMAIL PROTECTED]'; '[EMAIL PROTECTED]'
> >Subject: Ping times? Am i missing something
> >
> >
> >The other day while troubleshooting an issue, I saw some pings from out
> >Tivoli Netview box and it was showing ping times in the 15,000+ ms range.
Is
> >this possible? I though there was a limit on this particular field in the
> >head. If an of our frame-format experts (Priscilla?) or sniffer gurus
> >(again... Priscilla?), could point me someone I'd appreciate it. Thanks a
> >bunch!
> >_________________________________________________________________
> >Commercial lab list: http://www.groupstudy.com/list/commercial.html
> >Please discuss commercial lab solutions on this list.
________________________
Priscilla Oppenheimer
http://www.priscilla.com
Message Posted at:
http://www.groupstudy.com/form/read.php?f=7&i=41208&t=41151
--------------------------------------------------
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
