In the figure below, the client is querying the DNS server, asking about The DNS server (8.8.8.8) sends a DNS response to the client (192.168.1.52) with multiple “A” record inside the packet.

It is set by DNS server, informing the client (resolver) how long it should keep the DNS record in its cache before requesting a new one. When it reduces to 0 (zero), the packet gets dropped and an ICMP packet is sent back to the sender.ĪLSO READ: Analyze TCP Receive Window with Wireshark The TTL value is decreased by 1 every time the packet passes through a layer 3 device. TTL is 1-byte field which can be set to maximum 255. The purpose of TTL in IP headers is to prevent a network packet from circulating indefinitely. It refers to the number of hops that a packet can travel through before it gets discarded by a layer 3 device. Since it is a broad definition, I will break it into 3 categories to explain it better.

The generic definition of Time to Live (TTL) refers either life time of a network packet or expiration time of the cached data in a computer. TTL in Hyper Text Transfer Protocol (HTTP).

Wireshark capture examples