Common TTL (Time to Live) Values by OS

The TTL value in a ping command can be used to make an educated guess about the operating system of a remote host. While these values can be modified by network configurations, they serve as useful default indicators.

Using the ping Command to Guess OS

1. Windows OS

• Default TTL: 128
• Example:

Reply from 192.168.1.10: bytes=32 time<1ms TTL=128

2. Linux / Unix / macOS

• Default TTL: 64
• Example:

64 bytes from 10.0.0.5: icmp_seq=1 ttl=64 time=0.045 ms

3. Cisco Routers / Network Infrastructure

• Default TTL: 255
• Example:

Reply from 192.168.1.1: bytes=32 time<1ms TTL=255

Important Considerations

While TTL is a great clue, keep the following in mind:

• TTL Decrements: Every router a packet passes through subtracts 1 from the TTL. If you ping a Linux server (64) and it passes through 10 routers, you will see TTL=54.
• Obfuscation: Some security-conscious admins change default TTLs to hide the OS from potential attackers.
• Ambiguity: Since Linux and macOS share the same default (64), you cannot distinguish between them using TTL alone.

Conclusion

TTL is best used as one part of the puzzle, especially when combined with other methods like traceroute or banner grabbing for more accurate identification.