Which TCP field would indicate that a routing loop has occurred in a network?
Which TCP field would indicate that a routing loop has occurred in a network?
1 Answer
- Sort by
oldest newest most voted
0
The TTL is an IPv4 field. The hop count field is used in IPv6. The hop count is not tracked by TCP. If Wireshark thinks a packet is a duplicate, it will warn you. The Wireshark field for TTL is ip.ttl. You can try the display filter for ip.ttl==0, but don't be surprise if there aren't any matches. Before a packet is forwarded at layer 3, the TTL or hop count is decremented by 1. If result is zero, then the packet is discarded and the source IP is notified that the time exceeded (IPv4) or hop count exceeded (IPv6). Capture the "exceeded" packet, and it will show the source of the message.
A routing loop, low initial TTL, or non-optimal route can cause a TTL/hop count to exceed. What could be more helpful looking for a layer 3 loop is a traceroute. You will be looking for the repeat of the same addresses in the traceroute.
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments
Is this true? How can I view the TTL With a wireshark filter so see value of 0? Is it The TTL ( Time to live) field in TCP which is of 8-bit. Each packet that you sent will have value of this TTL field from 0-255 and when the value become zero, we consider a loop has occurred and we drop the packet.