TTL and traceroute showing different values for same domain

Question

Why am I getting two different outputs for tracert and ping?

Ping Result showing total hops of 20 and tracert showing 8.

Default ttl value on my Linux machine 64, icmp echo reply ttl value 44.

64-44=20

but tracert is showing only 8 hops.

What can be the reason?

If tracert is implemented using ttl then why am I getting different values for same domain, no matter how many times I tried?

For Google and Google services, ttl value and tracrt are same,but for other domains it's different.

How are you getting a hop count from ping? If you're using the TTL in the reply packet, you're doing it wrong. (Because that depends on the initial TTL value in the reply, which you don't know.) — David Schwartz, Oct 13 '12 at 05:36
How do you know what the initial TTL value *in the reply packet* is?! — David Schwartz, Oct 13 '12 at 06:09
/proc/sys/net/ipv4/ip_default_ttl this gives default ttl value on every linux machine. — Cray XT3, Oct 13 '12 at 06:10
this subtracted from reply packet gives no of hopes.This is how traceroute works,so far.... — Cray XT3, Oct 13 '12 at 06:11
In case of gmail and google its correct but for some other domains...its not — Cray XT3, Oct 13 '12 at 06:11

David Schwartz · Accepted Answer · 2012-10-13T06:18:54.830

What you are doing makes no sense and when it works, it works by luck. You have no idea what the inital TTL value is in the ping reply packet. That packet is sent by some remote machine over which you have no control (the one you pinged). You can't determine the hop count from the received TTL value without knowing the initial TTL value.

You do know the initial TTL of your outbound traceroute packets, since you composed them. That's why this works with traceroute, which is designed for this purpose. If you tried to make sense of the received TTL values in the ICMP responses to your traceroute packets, that would give the same nonsensical results that only work by luck that you get from ping.

Try it if you don't believe me. Do a traceroute and look at the received TTL values in the ICMP replies. You might see 51 from one hop and 238 from the very next one. This happens because the various devices use different initial TTL values in the replies they compose to you.

TTL and traceroute showing different values for same domain

1 Answers1