Using tcpdump/wireshark to capture low TTL values
We suspected a network anonaly where packets were expiring because of a low TTL value. You can capture packets with a given TTL value with the following tcpdump filter:
tcpdump -v ip and 'ip[8]<32'
This will filter out any packet with a TTL lower than 32, because the TTL byte is the 8th byte in the IP header.