Hops and TTL — how many routers away, and what the TTL gives away

Every router a packet crosses decrements its TTL. From the reply's TTL you can count the hops and usually name the remote OS.

How it works. Every packet starts with a *time to live* (TTL) and each router it crosses subtracts one; at zero it's discarded (that's how traceroute works — it sends packets with TTL 1, 2, 3… and listens for the routers that discard them).

Reading a reply's TTL. Operating systems start at fixed values: 64 (Linux, macOS, most network gear's *replies*), 128 (Windows), 255 (Cisco/BSD and some routers). A reply with TTL 128 came from a Windows host with no routers in between; TTL 61 came from a Linux host three routers away. n check and n bench print this inference.

What hops tell you

• 1 hop (same subnet) — nothing between you but a switch. Latency should be ≤ 1 ms wired; if it isn't, it's the link or the host, not the path.
• 2–3 hops at home — you crossed your router, maybe an ISP CPE. Normal for anything outside the LAN.
• More hops than expected to a LAN host — you're reaching it through a VPN (Tailscale, WireGuard), not the LAN. n bench flags this and prefers the LAN address when it can find one.

See the path

• Windows: tracert host · Linux: traceroute host or mtr host (live, with loss per hop) · macOS: traceroute host.