CCNA Network Services and Security Practice Question
Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?
⚠ Common exam trap
A frequent exam trap is selecting transport-layer fields like source port or sequence number as the field modified by each router hop. These fields are part of TCP or UDP headers and remain unchanged by routers during forwarding. Another common mistake is confusing the Ethernet frame CRC with the TTL; while the CRC is recalculated on each link to verify frame integrity, it does not control packet lifetime or prevent routing loops. Misunderstanding these distinctions can lead to incorrect answers about how routers manage packet forwarding and loop prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TTL
The Time to Live field is decremented at each hop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Source port
Why it's wrong here
Source port is a transport-layer identifier used by TCP or UDP to demultiplex applications at the receiving host. Routers are Layer 3 devices that do not examine or alter transport-layer headers; they forward IP packets without touching the TCP/UDP segment contents. Consequently, the source port remains identical across every router hop, and it is not a field that a router modifies for any purpose.
When this WOULD be correct
In a question asking about the transport layer's role in establishing connections, such as 'Which field is used to identify a specific application on a host in a TCP segment?', the source port would be the correct answer.
- ✓
TTL
Why this is correct
In IPv4, the Time-to-Live (TTL) field is set by the source and decremented by exactly one by every router that forwards the packet; when the counter reaches zero, the router drops the packet and sends an ICMP Time Exceeded message to the sender. This decrementing process is the standard hop-limit mechanism that prevents packets from circulating endlessly, and it is the only field in the IP header that each router modifies purely to manage network loop prevention.
- ✗
Sequence number
Why it's wrong here
TCP sequence numbers are part of the transport-layer protocol, used to order segments and detect missing packets in a byte stream. IPv4 routers are unaware of TCP mechanics because they work only with the IP header and do not parse the payload, so they never inspect or change sequence numbers. The sequence number is thus entirely unaffected by router forwarding and cannot be the field that each hop modifies.
When this WOULD be correct
If the question were about TCP packets specifically, asking which field is modified to ensure data is received in the correct order, then the sequence number would be the correct answer, as it is crucial for maintaining the integrity of the data stream.
- ✗
CRC in the Ethernet trailer
Why it's wrong here
The Ethernet trailer's cyclic redundancy check (actually the frame check sequence) is a layer-2 mechanism that verifies the integrity of a single frame on a specific link. When a router receives an Ethernet frame, it strips that frame, processes the IP packet, and then builds a new frame with a freshly computed CRC before forwarding out another interface. The per-hop recalculation of the frame CRC is not the IP loop-prevention field; it is the IP TTL that is decremented, so this option confuses link-layer integrity protection with the network-layer hop counter.
When this WOULD be correct
If the exam question asked about fields modified in the data link layer or specifically about Ethernet frame structures, then 'CRC in the Ethernet trailer' could be correct as it would pertain to error detection in frames at that layer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓TTLCorrect answer▾
Why this is correct
In IPv4, the Time-to-Live (TTL) field is set by the source and decremented by exactly one by every router that forwards the packet; when the counter reaches zero, the router drops the packet and sends an ICMP Time Exceeded message to the sender. This decrementing process is the standard hop-limit mechanism that prevents packets from circulating endlessly, and it is the only field in the IP header that each router modifies purely to manage network loop prevention.
✗Source portWrong answer — click to see why▾
Why this is wrong here
The source port is a field in the transport layer (TCP/UDP) header, not in the IPv4 packet header, and it does not play a role in preventing forwarding loops in routing.
★ When this WOULD be the correct answer
In a question asking about the transport layer's role in establishing connections, such as 'Which field is used to identify a specific application on a host in a TCP segment?', the source port would be the correct answer.
Why candidates choose this
Candidates may confuse the source port with other fields that manage packet flow, mistakenly believing it plays a role in routing behavior, especially if they are thinking about connection-oriented protocols.
✗Sequence numberWrong answer — click to see why▾
Why this is wrong here
The sequence number is a field used in protocols like TCP to ensure data is delivered in order, but it is not modified by routers during packet forwarding. Routers do not alter the sequence number in IPv4 packets.
★ When this WOULD be the correct answer
If the question were about TCP packets specifically, asking which field is modified to ensure data is received in the correct order, then the sequence number would be the correct answer, as it is crucial for maintaining the integrity of the data stream.
Why candidates choose this
Candidates may confuse the sequence number with other fields that are modified during packet transmission, leading them to mistakenly believe it plays a role in routing decisions, especially if they have a basic understanding of TCP/IP protocols.
✗CRC in the Ethernet trailerWrong answer — click to see why▾
Why this is wrong here
The CRC (Cyclic Redundancy Check) in the Ethernet trailer is used for error-checking of the frame and is not modified by routers during packet forwarding. It does not play a role in preventing forwarding loops in IPv4 packets.
★ When this WOULD be the correct answer
If the exam question asked about fields modified in the data link layer or specifically about Ethernet frame structures, then 'CRC in the Ethernet trailer' could be correct as it would pertain to error detection in frames at that layer.
Why candidates choose this
Candidates may confuse the role of CRC in ensuring data integrity with the need to manage packet forwarding, leading them to mistakenly think it relates to loop prevention.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
TTL
TTL (Time to Live) is a field in IP packets that limits the number of hops a packet can traverse before being discarded.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.