Sensors and Troubleshooting › CA Network Flow Analysis Sensors › TTL Expired Sources

TTL Expired Sources

The TTL Expired Sources sensor looks for possible router misconfiguration, such as routing loops, by monitoring for time to live (TTL) expiration messages.

Troubleshooting a TTL Expired Sources Alert

An alert from the TTL Expired Sources sensor may indicate one of the following issues:

• A network configuration issue such as a routing loop or equipment problem. A routing loop occurs when packets are routed incorrectly so that they travel in a continuous circle. The loop typically occurs when a router or line fails before routine notifications about the link failure have had time to reach the other network routers. Routing loops often appear when network changes are made.

  Try to identify and correct any network outage that becomes apparent. Try to find any "black hole" network ranges and check the associated routers.

• Heavy traceroute activity.

  Investigate any unusual traceroute activity to determine whether the activity is legitimate. For example, investigate whether the traceroute activity is performed for testing or troubleshooting.