Quiz Entry - updated: 2026.07.14
What is an ICMP Time Exceeded message and when is it sent?
A router sends it to the source when a packet's TTL (IPv4) or Hop Limit (IPv6) is decremented to 0 and the packet is discarded. Traceroute relies on these replies to map the path.
ICMP Time Exceeded Message:
Sent when a packet's Time to Live (TTL) field is decremented to 0.
* Each router decrements TTL; when it hits zero the packet is dropped and a Time Exceeded message goes back to the source — the basis of traceroute. *
IPv4 vs IPv6:
| Protocol | Field Name | Purpose |
|---|---|---|
| IPv4 | Time to Live (TTL) | Prevents infinite loops |
| IPv6 | Hop Limit | Same purpose as TTL |
When Time Exceeded occurs:
- Packet enters a router
- Router decrements TTL/Hop Limit by 1
- If result is 0, router discards packet
- Router sends Time Exceeded message to source
Example output:
Pinging 8.8.8.8 with 32 bytes of data:
Reply from 192.168.1.1: TTL expired in transit.
Reply from 192.168.1.1: TTL expired in transit.
Key insight: Time Exceeded messages are used by the traceroute tool to discover the path packets take through a network.
Go deeper:
RFC 792 — Internet Control Message Protocol — defines the Time Exceeded message sent when TTL reaches zero.- Traceroute — Wikipedia — shows how tools exploit TTL expiry and Time Exceeded replies to map a path.