Follow routers and hop limits

A router receives a frame, removes the link header, examines the IP destination, chooses a route, and sends the packet inside a new frame for the next link. It repeats this for every packet, at every hop, all the way to the destination network.

The link-layer addresses change at each routed hop: every new frame carries the MAC addresses of that specific link. The source and destination IP addresses normally remain the same end to end, except when a device deliberately translates them, as NAT does.

The loop-prevention counter

Routing tables are written by humans and protocols, and both make mistakes. If router A sends packets to router B, and B sends them back to A, a packet could circulate forever, and enough of them would melt the network.

The fix is a counter in every IP header. IPv4 calls its loop-prevention field Time to Live, while IPv6 calls it Hop Limit. Each router reduces the value by one. If it reaches zero, the router discards the packet and normally sends an ICMP “Time Exceeded” error back to the source.

You can trigger this on purpose. Send a ping that’s only allowed one hop:

ping -c 1 -t 1 1.1.1.1        # Linux: -t sets the TTL

From 192.168.1.1 icmp_seq=1 Time to live exceeded

On macOS the flag is -m:

ping -c 1 -m 1 1.1.1.1

The reply doesn’t come from 1.1.1.1. It comes from 192.168.1.1 — your router, the first hop — telling you it discarded your packet because the TTL ran out there. Raise the limit to 2 and the discard message comes from the next router instead.

Count the hops on a real path

A normal reply also reveals distance. Ping a server and look at the ttl in the response:

ping -c 1 1.1.1.1
# 64 bytes from 1.1.1.1: icmp_seq=1 ttl=57 time=9.8 ms

The server sent that reply with a starting TTL, commonly 64. It arrived with 57, so the return path crossed 7 routers.

This mechanism prevents a routing loop from circulating a packet forever. It also gives traceroute a way to reveal successive routers along a path — traceroute is nothing more than the -t 1, -t 2, -t 3 trick performed systematically, collecting the address of whoever sends each Time Exceeded error. You just did one round of it by hand.