Refer to the exhibit. While troubleshooting a routing issue, an engineer issues a ping from S1 to S2. Which two actions result from the initial value of the TTL?
(Choose two.)
Refer to the exhibit. While troubleshooting a routing issue, an engineer issues a ping from S1 to S2. Which two actions result from the initial value of the TTL?
(Choose two.)
When the packet leaves S1, the initial Time To Live (TTL) value is 2. The TTL is decremented by 1 each time the packet passes through a router. When the packet reaches R1, the TTL is reduced to 1. When the packet reaches R2, the TTL is decremented to 0. Since the TTL has reached 0 at R2, R2 will discard the packet and reply with an ICMP Time Exceeded message to the source. Therefore, the two resulting actions are that the packet reaches R2 and the TTL expires, and R2 replies with a TTL exceeded message.
It is A & D. Source MAC in the capture is VMWare, Dest MAC is Cisco. Routers first check the TTL before any further process, subtact 1 at R1. Send to R2, subtract and you have ZERO. Discard packet and reply with ICMP Time Exceeded message from that point, don't even bother checking the Route table for futher processing. If Packet was sourced from R1, then R3 would be the last hop and TTL would expire.
From the CCNP book: "The TTL is a Layer 3 loop prevention mechanism that reduces a packet’s TTL field by 1 for every Layer 3 hop. If a router receives a packet with a TTL of 0, the packet is discarded." When it reaches R1, it has a TTL of 2 , it only has a TTL of 1 when it exits R1. "If Packet was sourced from R1, then R3 would be the last hop and TTL would expire" - exactly, last hop is R3, so R3 will reply with a TTL exceeded messages, therefore C and E are correct.
But, you suppose the IP packet with TTL=0 travels from R2 to R3, What sense will have that action if you know R3 will drope it just after receive it ? It's more logic R2 inmediately drop it
When a router in the path finds that the TTL is 1, it responds to the source with an ICMP “time exceeded” message. This lets the source know that the packet traversed that particular router as a hop. I will go for A and D as well.
But it's R1 that sets the TTL of 2 so shouldn't the TTL expire at R3..?
TTL=2 is set on initial echo request as the packet is captured before entering R1 - note the vmware ethernet mac header. if it was on any other routing segment, src mac address would be the one of cisco's.
I think, the given answer is correct. When packet is arrived to R1 TTL is 2. It decrease TTL to 1 and send packet to R2. R2 decrease TTL to 0 and send packet with TTL 0 to R3. R3 receive packet with TTL 0 so reply with "Time to live exceeded in transit“. Or am I wrong ?
you are correct, the CCNP book says "The TTL is a Layer 3 loop prevention mechanism that reduces a packet’s TTL field by 1 for every Layer 3 hop. If a router receives a packet with a TTL of 0, the packet is discarded." R2 sees the packet with a TTL of 1, it only has a TTL of 0 when exits R2 towards R3, but in that instance R2 is not taking care of the packet anymore.
I have simulated the exact scenario, and the answer is AD
Tested in CML Each router decrements the TTL by 1. The packet’s first hop being the gateway of the Device will now have a TTL of 1, the second hop being R2 now has a TTL of 0, meaning the packet has reached R2 but expired, never actually making it to R3. R2 then replies with a TTL exceeded message back to the client. S1@linux:~$ ping -t 2 192.168.3.1 PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data. From 192.168.12.2 icmp_seq=1 Time to live exceeded --- 192.168.3.1 ping statistics --- 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms When I change the TTL to 3 S1@linux:~$ ping -t 3 192.168.3.1 PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data. 64 bytes from 192.168.3.1: icmp_seq=1 ttl=253 time=65.2 ms --- 192.168.3.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 50.672/57.919/65.166/7.247 ms
A. The packet reaches R2, and the TTL expires. When the packet leaves S1, the TTL decreases by 1 when it hits R1, and then by 1 again as it reaches R2, at which point the TTL is expired. D. R2 replies with a TTL exceeded message. Since the TTL has expired upon reaching R2, R2 will generate an ICMP Time Exceeded message and send it back to the source IP address to indicate that the TTL has expired.
if the packet is captured on VM server then AD
As per the showing exhibit, the packet was captured in the R1's interface that connected to S1(Consider based on showing Scr and Dst MAC address). S1 will send the packet with TTL value 2 origin. R1 will reduce the TTL value to 1 before sending it to R2. So the packet will reach R2 with the TTL value 1. R2 will reduce the TTL value to 0 before sending and no longer forwards the packet to R3, and then drops it.
Edit: The packet may be captured on the output of the S1 interface. The answer: A, D.
I have already tested in my Lab and no packet was reached to the R2 exit interface and R3. And R2 reply as TTL expired. VPCS> ping 192.168.3.1 -T 2 *192.168.12.2 icmp_seq=1 ttl=254 time=0.692 ms (ICMP type:11, code:0, TTL expired in transit) *192.168.12.2 icmp_seq=2 ttl=254 time=0.604 ms (ICMP type:11, code:0, TTL expired in transit) *192.168.12.2 icmp_seq=3 ttl=254 time=0.721 ms (ICMP type:11, code:0, TTL expired in transit) *192.168.12.2 icmp_seq=4 ttl=254 time=1.126 ms (ICMP type:11, code:0, TTL expired in transit) *192.168.12.2 icmp_seq=5 ttl=254 time=0.499 ms (ICMP type:11, code:0, TTL expired in transit) VPCS>
The correct answers are A and D I just checked in EVE-NG and the TTL exceeded answer is sent from 192.168.12.2 to 192.168.1.1. It seems that: - R1 receives the packet, decreases the TTL to 1 and forwards it towards R2. - R2 receives the packet, decreases the TTL to 0, discards it and sends a TTL Exceeded message to S1
So the packet reaches R2 and TTL expires, R2 discars this packet and sends TTL expired message...
A & D Routers always decrement the TTL by 1 and forward the packet if the new TTL is greater than zero. If it is zero, some routers issue a ICMP time exceeded in transit packet as you've noticed, but some don't (mostly for security reasons).
C and E are correct. Each router reduces TTL and forwards the packet, R3 receives a TTL 0 and responds.
A & D are correct
Routers decrement the TTL by 1 every time they forward a packet, if a router decrements the TTL to 0, it throws away the packet. This prevents packets from rotating forever. If a router finds a packet with TTL value of 0, it drops the datagram and sends an ICMP time-to-live-exceeded message to the sender. In the question if the initial TTL is 2, then R1 receives the packet with TTL of 2, then it decreases the TTL before forwarding to R2. R2 receives packet with TTL of 1 then decreases the TTL to 0 so R2 drops the packet and replies back to the source with an ICMPv4 Type 11 Code 0 Time Exceeded message. https://www.cisco.com/c/en/us/td/docs/routers/ir910/software/release/1_1/configuration/guide/ir910scg/swtrbl.pdf
TTL is decremented by 1 at each L3-forwarding host until 0
The packet is sourced at S1 see the IP address 192.168.1.1 which is S1. So A and D is correct
The right answer is C & E. The TTL is decremented on each hop along the path. R1 to R2 (2 - 1 = 1), R2 to R3 (1 - 1 = 0). Once R3 receives the packet with a TTL of 0, the packet is discarded and R3 sends the ICMP Time Exceeded message
its A&D , R1(TTL-1=1) sends to R2(TTL-1=0) , a router won't send out a packet with ttl 0 rather will respond with TTL expired , Every time a router receives a packet, it subtracts one from the TTL count and then passes it onto the next location in the network. If at any point the TTL count is equal to zero after the subtraction, the router will discard the packet and send an ICMP message back to the originating host.
When a packet is by a router, the router subtracts 1 from the TTL count. Then, the packet travels to the next destination on the network. When the TTL count is 0, after the final subtraction, the packet is discarded by the router. This triggers an Internet Control Message Protocol (ICMP) message that's sent back to the originating host.
When a router receives a packet with TTL = 1 if the destination of the packet is not itself it will drop the packet. In this question, R2 will drop the packet and reply with an ICMP type 11 (time exceeded) message https://www.youtube.com/watch?v=zesTvBZCESk&list=PLxbwE86jKRgOb2uny1CYEzyRy_mc-lE39&index=21&ab_channel=Jeremy%27sITLab