Dynamics of the IP Time To Live field in internet traffic flows

The Time To Live (TTL) field present in the IP protocol header is used to limit the lifetime of packets in the network. Previous research has measured TTL for studying path lengths and dynamics in IP networks, and for detecting route changes. How the TTL varies over short timescales of subsequent packets of traffic flows has not yet been analysed. Such knowledge is needed for passively detecting route changes based on existing traffic in the network or traffic traces, and for designing mechanisms that modulate the TTL field such as IP traceback techniques and covert channels. In this paper we analyse small time scale TTL variation in Internet traffic flows based on a number of packet traces captured at different locations in the Internet.