Why when you ping a host in a LAN the TTL value is 128 but if you ping a host in another network the TTL value decreases from 255 to 254 my question is why the TTL value is 128?

The TTL or Time To Live is a value used to make packets eventually die, so they don't end up in infinite loops, clogging the network over time. Certain network devices decrement this value (routers mainly) by one as they process it. When the TTL reaches zero, the packet is discarded. Each Operating System implements its TCP/IP stack differently and starts packets off with the TTL of their choosing (the default TTL of the stack can be changed, but rarely is). Windows is 128 Linux is 64 Cisco is 256 So if your TTL is around 128 (remember the TTL gets decremented by certain devices) you are PROBABLY pinging a windows box. If it's near 256, probably Cisco etc. You can't rely on this information because other network devices can rewrite the TTL in a packet, but it's a decent indication of the OS on the other end, especially if it's a box you own and you aren't going through firewalls etc.