What does TTL stand for?
TTL stands for Time to Live. A hop counter in the IP header that each router decrements; at zero the packet is discarded, which prevents endless loops. In DNS, TTL is instead how many seconds a resolver may cache a record before asking again.
TTL has two meanings in networking. In an IP packet it is a counter in the header: the sender sets it, and every router that forwards the packet lowers it by at least one. A router that brings it to zero discards the packet and sends an ICMP time exceeded message back to the sender. This stops packets caught in a routing loop from circulating for ever, and it is the mechanism that traceroute uses. IPv6 calls the same field Hop Limit. In DNS, TTL is a number of seconds attached to each record, which tells resolvers how long they may cache the answer.
TTL in practice: an example
Before moving a website to a new server, the administrator lowers the TTL of its address record from one day to five minutes and waits a day. When the address is then changed, resolvers that cached the old answer ask again within five minutes, so almost all visitors reach the new server at once. Afterwards the TTL is raised again.
What TTL is confused with
TTL vs hop count: what is the difference?
Hop count is a routing metric: how many routers lie between two networks. TTL is a field in each packet that limits how many hops that packet may still travel.
TTL vs lease time: what is the difference?
A DHCP lease time is how long a client may keep its address. A DNS TTL is how long an answer may be cached. Both are timers, but for different services.
Which exams cover TTL?
TTL is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 1.0 (Networking Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which tool relies on routers returning ICMP time exceeded messages when a packet's TTL reaches zero?
- traceroute (tracert)
- nslookup
- ipconfig
- netstat
Show the answer
A. traceroute (tracert). Traceroute sends packets with TTL 1, 2, 3 and so on. Each router that discards one reveals itself with a time exceeded message, which maps the path hop by hop.
2. A DNS record was changed an hour ago, but some users still reach the old address. The record's TTL is 86400. What explains this?
- Resolvers may keep the old answer cached for up to 24 hours
- The record was deleted by the registrar
- A TTL of 86400 blocks IPv6 clients
- The switch's MAC address table is full
Show the answer
A. Resolvers may keep the old answer cached for up to 24 hours. 86400 seconds is one day. A resolver that cached the old answer before the change can keep using it until that time runs out.
Sources: RFC 791: Internet Protocol; RFC 1035: Domain Names - Implementation and Specification; RFC 8200: Internet Protocol, Version 6 (IPv6) Specification; Microsoft Learn: tracert. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.