ICMP Echo round-trip and TTL-expiry hop discovery across a 6-node path
This simulator illustrates two of the most common diagnostic tools in networking. The Ping mode animates a full ICMP Echo Request/Reply round trip hop by hop across routers and switches, showing exactly where the TTL field decrements and where it does not. The Traceroute mode shows how deliberately sending probes with an incrementing, artificially low TTL causes each router along the path to reveal itself one at a time via ICMP Time Exceeded messages.
Ping sends an ICMP Echo Request (Type 8, Code 0) to a destination IP address. If the destination is reachable and configured to respond, its IP stack replies with an ICMP Echo Reply (Type 0, Code 0). Every Layer 3 hop along the path — routers — decrements the packet's TTL (Time To Live) field by exactly 1 and recalculates the IP checksum; Layer 2 devices like switches forward the frame unchanged, without touching the IP header at all. The overall round-trip time (RTT) reported by ping is the time between sending the request and receiving the matching reply.
Traceroute (tracert on Windows) exploits the TTL-expiry mechanism deliberately. It first sends a probe with TTL=1: the very first router decrements it to 0, discards the packet, and must send back an ICMP Time Exceeded (Type 11) message — revealing that router's IP address as hop 1. Traceroute then sends a probe with TTL=2, which survives the first router but expires at the second, revealing hop 2, and so on, incrementing TTL by 1 each round until a probe finally reaches the actual destination, which replies normally instead of with a Time Exceeded message.
TTL is a field in the IP header (Layer 3) — plain Ethernet switches operate at Layer 2 and never inspect or modify IP headers, so they never decrement TTL and never generate a Time Exceeded message. Only Layer 3 devices (routers, Layer 3 switches, and any host doing IP forwarding) participate in the TTL mechanism, which is exactly why a traceroute across a path like PC → Switch → Router → Router → Switch → Server only ever lists the two routers and the final server, never either switch.
This usually means that particular router is configured to rate-limit, deprioritize, or simply not generate ICMP Time Exceeded replies (a common security/performance practice), not that the path is actually broken — traffic is very likely still flowing through it correctly to later hops.
Different operating systems use different default starting TTLs — commonly 64 for Linux/macOS, 128 for Windows, and 255 for Cisco IOS. Because TTL decrements by exactly 1 per router hop, the TTL value observed in a received packet can be used to estimate how many router hops away the sender is, which is sometimes used for OS fingerprinting or anomaly detection.
It depends on the implementation: Windows' tracert sends ICMP Echo Requests with incrementing TTL. Traditional Unix/Linux traceroute instead sends UDP packets to a high, typically-closed destination port, relying on the same TTL-expiry mechanism for intermediate hops and an ICMP Port Unreachable message from the final destination. Both approaches reveal the same underlying path.
Yes — many firewalls and routers are configured to drop or rate-limit ICMP Echo Requests and Time Exceeded messages as a security hardening measure, since ICMP has historically been used for reconnaissance and certain denial-of-service techniques. This can make a perfectly healthy path appear to "time out" in ping or traceroute even though normal application traffic (HTTP, DNS, etc.) passes through it fine.
Try our Enterprise IT Networks Studio
More calculators, simulators, and guides for this discipline.