ICMP Time Exceeded

The ICMP error (type 11, type 3 in ICMPv6) sent when a packet's TTL runs out in transit or its fragments miss reassembly.

Traceroute is built on it, and in RFC 4443's words it indicates either a routing loop or too small an initial hop limit. When a router does not send it, a trace shows asterisks, and a filter, a rate limit and a router configured to stay silent all look the same.

RFC 792 defines two codes: 0, time to live exceeded in transit, which may come from a gateway, and 1, fragment reassembly time exceeded, which may come from a host that gave up reassembling a datagram and need not be sent at all if fragment zero never arrived. ICMPv6 keeps both under type 3, code 0 reading hop limit exceeded in transit.

RFC 792 left it optional: a gateway may notify the source. RFC 1812 makes it a MUST for a router that discards a packet for an expired TTL, unless the destination is multicast, because traceroute depends on it, and allows a per-interface option to stop it that must default to sending. Routers should be able to rate-limit it, and IPv6 nodes must, by a method that copes with traceroute's bursts.

Like every ICMP error it quotes the packet that caused it: the IP header and at least 8 data bytes, and from routers as much as fits in 576 bytes, so the sender can match it to a probe by ports or sequence number. tcpdump prints ICMP time exceeded in-transit, and the ICMP bytes start 0b 00, type 11 and code 0. RFC 4890 puts ICMPv6 Time Exceeded code 0, and only code 0, among the messages a firewall must not drop.

Also known as: time exceeded, ttl exceeded in transit, hop limit exceeded in transit, icmp type 11, fragment reassembly time exceeded

Sources

← All glossary entries