TTL / OS Fingerprint Reference

Every IP packet's Time To Live counts down by one at each router hop, and different operating systems start that countdown from different default values. Enter the TTL you see in a ping reply or a packet capture, and this works backward to the likely starting value — and from there, a reasonable guess at the OS on the other end and how many hops away it is.

The defaults worth actually knowing

• 64 — Linux, Android, macOS, iOS, and most modern Unix/BSD systems. The one you'll see constantly.
• 128 — every modern version of Windows, from XP through current Server releases.
• 255 — Cisco IOS, Solaris, and a fair amount of network appliance firmware. Networking gear defaults high because it's often intentionally close to the network core, and 255 leaves the most room.

How the backward calculation actually works

You never see the starting TTL directly — you see whatever's left after every router along the path decremented it by one. A reply with TTL 57 almost certainly started at 64 and crossed 7 hops, since 57 is closer to a standard 64 than trying to explain it as 128 minus an implausible 71 hops. Find the nearest standard starting value at or above what you observed, and the difference is your hop count estimate.

Why this is a strong hint, not a guarantee

TTL is a single byte in the IP header, and it's trivially adjustable — some administrators intentionally set a custom starting TTL specifically to make OS fingerprinting harder, and a handful of niche or embedded stacks simply don't follow the common defaults. It's also just one signal among several a real fingerprinting tool would use — TCP window size, options ordering, and other stack-specific quirks reveal more together than TTL does on its own. Treat this as a fast first read during triage or troubleshooting, not something to state with confidence in an incident report on its own.

Where this actually comes up

Quickly sanity-checking what's likely on the other end of a ping without a full port scan, spotting a TTL that looks inconsistent with what a host claims to be during an investigation, or just satisfying curiosity about a packet capture — this is a fast, zero-setup first pass before reaching for heavier tools like nmap -O that do a much more thorough job when you actually need certainty.