TTL Jumps: Unexpected TTL Rewrites Impacting Inferences from Traceroutes

Authors: Sebastian Kappes, Anja Feldmann, Tobias Fiebig, Johannes Zirngibl

Published in Proc. ACM Int. Measurement Conference (IMC), 2026

Abstract:
Traceroute is an important Internet measurement tool used to infer the Internet’s topology and to identify middleboxes. It relies on network devices decrementing the Time to Live (TTL) in IP packet headers by one at each hop and sending Internet Control Message Protocol (ICMP) Time Exceeded error messages if the TTL reaches zero. However, we show that TTL jumps exist on the Internet: some devices rewrite the TTL, often to larger value of up to 255. These rewrites hide the remaining path from traceroute and can lead to incorrect inferences like spurious router and Autonomous System (AS) links. Based on controlled experiments and public data from RIPE Atlas and CAIDA Ark, we show that at least 47 ASes are impacted by path-impairing devices that rewrite the TTL. A prominent example is AT&T where more than 90 % of outgoing IPv6 paths from CAIDA Ark nodes are affected since 2023.

Recommended citation: Sebastian Kappes, Anja Feldmann, Tobias Fiebig, Johannes Zirngibl, "TTL Jumps: Unexpected TTL Rewrites Impacting Inferences from Traceroutes." Proc. ACM Int. Measurement Conference (IMC), 2026.