Why do TTLs differ in a ping

Question

If I send a ping to a certain machine across the country with a ttl equal to 15, why does the response from the server have a ttl of 51?

Answer 1

The TTL you set is on the echo request (from you to the remote host), the TTL you are seeing is the echo response (from the remote host to you). The remote host OS determines what the TTL starts at (or you can say it starts at 255 with the responding host deducting a set amount) and then every hop deducts 1.

Example: If you ping a Windows host, it will start at 128, and then if there are 12 hops, you'll see a TTL of 116 (128-12). In your question you say it's 51, so that could be a *nix host (starts at 64) with 13 hops.

Here's a chart of starting values: http://www.kellyodonnell.com/content/determining-os-type-ping