A Good Interview Question for “Network Engineers”: What is TTL?

So, lately I’ve been coming up with little questions to separate the “men from the boys” (sorry, ladies) when it comes to interviewing people for network and systems administration. One great question, I think, is asking someone what TTL stands for in traceroute. Since traceroute is ICMP, and ping is ICMP, then one would think that like ping, TTL is the time to live in milliseconds, right?

WRONG! “TTL reply” in ping is completely different than the “TTL in transit” in traceroute. Traceroute sends out an ICMP echo packet to a host, but with a TTL of 1 (then TTL 2, TTL 3, etc). Once the host gets the standard ICMP ‘echo rely’ packet back from the final host, traceroute gets a ‘TTL expired in transit’ message back.