· 1 min read
Changing the default IP TTL on macOS, Linux, and OpenWrt
Temporary TTL and IPv6 hop-limit changes for network testing, plus the router equivalents.
Loading post…
· 1 min read
Temporary TTL and IPv6 hop-limit changes for network testing, plus the router equivalents.
Loading post…
Every router that forwards an IPv4 packet reduces its time to live (TTL) by one. IPv6 calls the same field the hop limit. This prevents routing loops from circulating packets forever, and it also makes the number of forwarding hops observable.
Changing the starting value is occasionally useful when reproducing a network path or testing firewall behavior. It is not reliable device identification: operating systems use different defaults, routes differ, and software can rewrite the field.
These commands change new IPv4 and IPv6 traffic until the next reboot:
sudo sysctl -w net.ipv4.ip_default_ttl=65
sudo sysctl -w net.ipv6.conf.default.hop_limit=65
To make the values persistent, place them in a dedicated sysctl file:
sudo tee /etc/sysctl.d/90-local-ttl.conf >/dev/null <<'EOF'
net.ipv4.ip_default_ttl = 65
net.ipv6.conf.default.hop_limit = 65
EOF
sudo sysctl --system
The macOS equivalents are also temporary:
sudo sysctl -w net.inet.ip.ttl=65
sudo sysctl -w net.inet6.ip6.hlim=65
Confirm the current values with sysctl net.inet.ip.ttl and
sysctl net.inet6.ip6.hlim.
Changing a host default affects packets created by that host. A router needs a post-routing rule to modify forwarded traffic. With iptables, scope the rule to the actual WAN interface instead of touching every packet:
sudo iptables -t mangle -C POSTROUTING -o wwan0 -j TTL --ttl-set 65 || \
sudo iptables -t mangle -I POSTROUTING 1 -o wwan0 -j TTL --ttl-set 65
On nftables, the equivalent can handle IPv4 and IPv6 in one table:
table inet ttl_test {
chain postrouting {
type filter hook postrouting priority mangle; policy accept;
oifname "wwan0" ip ttl set 65
oifname "wwan0" ip6 hoplimit set 65
}
}
Replace wwan0 with the correct egress interface. On OpenWrt, make the rule through
the firewall configuration rather than editing an automatically generated ruleset.
Packet capture is the best verification:
sudo tcpdump -ni wwan0 'ip or ip6'
The nftables syntax is documented in the upstream
nft manual.
Comments
View on GitHub