Each forwarding router reduces it by at least one; at zero, the packet is discarded and the router normally returns an Internet Control Message Protocol (ICMP) Time Exceeded message. Internet Protocol version 6 (IPv6) provides the same function through Hop Limit.
Although IPv4 defined time-based semantics, forwarding makes TTL effectively a hop-count limit. Its purpose is to stop packets from circulating indefinitely in routing loops. Senders choose an initial value, and traceroute deliberately varies it to elicit responses from successive routers.
Key points
At the senderThe operating system or application places an initial TTL or Hop Limit in each packet; the value must be high enough for the intended path, while higher values allow more forwarding hops before expiry.
At a routerForwarding decrements the field. Expiry stops the packet and may generate an ICMP error, subject to ICMP rules and rate limits.
Diagnostic valueA received packet’s remaining value and expiry responses can support path troubleshooting, but tunnels, middleboxes, differing initial values, and route changes complicate interpretation.
Important limitationTTL is not an authentication, integrity, or authorization control. A sender can choose the initial value, so observed TTL alone does not reliably identify an operating system, establish proximity, or prove that traffic is trustworthy.