Computer Networks Interview Questions

The OSI model describes networking in seven layers, from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, and Application. The Physical layer carries raw bits, the Data Link layer handles frames and MAC addressing, the Network layer handles IP addressing and routing, and the Transport layer handles end-to-end delivery with TCP or UDP. The top three layers manage sessions, data format and encryption, and the application protocols themselves. A common memory aid is "Please Do Not Throw Sausage Pizza Away."

The TCP/IP model is the four-layer model the internet actually runs on: Link (or Network Access), Internet, Transport, and Application. It maps onto OSI by collapsing layers: OSI Physical and Data Link become the Link layer, OSI Network becomes Internet, Transport maps one to one, and OSI Session, Presentation and Application all collapse into the single TCP/IP Application layer. OSI is the teaching and troubleshooting reference; TCP/IP is the implemented stack. Interviewers usually want you to say that OSI is descriptive and TCP/IP is prescriptive.

Layering splits an enormous problem into independent pieces, each with a defined interface to the layer above and below. That means you can change Wi-Fi for Ethernet at the link layer without touching TCP, or swap HTTP for SMTP without touching IP. It also makes troubleshooting systematic, because you can isolate a fault to one layer at a time. The cost is a little overhead from each layer adding its own header.

Encapsulation is the process of each layer wrapping the data it receives from the layer above in its own header (and sometimes trailer) as it moves down the stack. Application data becomes a TCP segment, which becomes an IP packet, which becomes an Ethernet frame. Decapsulation is the reverse on the receiving host: each layer strips its own header and hands the payload up. This is why a small HTTP request still produces a noticeably larger frame on the wire.

The unit of data has a different name per layer: bits at the Physical layer, frames at the Data Link layer, packets (or datagrams) at the Network layer, segments for TCP and datagrams for UDP at the Transport layer, and simply data or messages at the upper layers. Interviewers ask this to check you do not use "packet" as a catch-all term. Being precise about segment versus packet versus frame signals that you understand where each header is added.

A LAN (Local Area Network) covers a small area such as a home, office or campus, is usually privately owned, and offers high speed with very low latency. A MAN (Metropolitan Area Network) spans a city, typically linking multiple LANs for one organisation or an ISP. A WAN (Wide Area Network) spans countries or continents and normally uses leased lines or public infrastructure; the internet is the largest WAN. As the area grows, latency and cost rise and typical throughput per user falls.

Topology describes how nodes are physically or logically arranged. Bus connects everything to one shared backbone and is cheap but fails entirely if the backbone breaks. Star wires every node to a central switch and is the standard for modern Ethernet, since one failed link affects only one node. Ring passes data node to node in a loop, and mesh connects nodes to many others for redundancy at high cabling cost. Real networks are usually a hybrid, most often star-of-stars.

In client-server, a dedicated server holds the resources and clients make requests to it, which centralises control, security and backup but creates a single point of failure and a scaling bottleneck. In peer-to-peer, every node acts as both client and server and shares resources directly, which scales cheaply and has no single point of failure but is harder to secure and manage. BitTorrent and blockchain networks are peer-to-peer; almost all web applications are client-server.

Unicast sends to exactly one destination and is the normal case. Broadcast sends to every host on a subnet, which is how ARP and DHCP discovery work; IPv6 dropped broadcast entirely. Multicast sends one copy that the network duplicates only where needed, so it is efficient for live video or routing protocol updates. Anycast advertises the same address from many locations and routing delivers to the nearest instance, which is how public DNS resolvers and CDNs get low latency.

A service is what a layer offers to the layer above it, expressed as a set of primitives such as "deliver this reliably". A protocol is the set of rules and message formats that peer entities at the same layer use between two machines to actually implement that service. In short, a service is the interface and a protocol is the implementation, which is why the service a layer offers can stay stable while the protocol underneath is replaced.

Connection-oriented communication sets up state on both endpoints before any data flows, keeps that state for the duration, and tears it down afterwards, which lets it number, acknowledge and reorder data; TCP is the example. Connectionless communication sends each unit independently with no prior setup and no shared state, so each datagram is routed on its own and may arrive out of order or not at all; UDP and IP itself are the examples. Connection-oriented buys reliability at the cost of setup latency and per-connection memory.

TCP is connection-oriented and reliable: it establishes a connection with a handshake, guarantees ordered delivery, retransmits lost packets, and provides flow and congestion control. UDP is connectionless and best-effort: it just sends datagrams with no guarantee of delivery or ordering, which makes it faster with less overhead. You use TCP for web pages, email, and file transfer, and UDP for latency-sensitive traffic like video streaming, voice calls, online gaming, and DNS lookups.

The three-way handshake sets up a TCP connection in three steps. First the client sends a SYN packet with an initial sequence number. The server replies with a SYN-ACK, acknowledging the client and sending its own sequence number. Finally the client sends an ACK back, and the connection is established so data can flow. This exchange synchronizes sequence numbers on both sides before any data is sent.

Closing takes four steps because TCP connections are full duplex, so each direction must be shut down separately. The side that finishes sends FIN, the peer acknowledges it with ACK, and that side may keep sending data; when it is also done it sends its own FIN, which the first side acknowledges. Only after both FIN and ACK pairs have been exchanged is the connection fully closed. The initiating side then sits in TIME_WAIT before releasing the socket.

After sending the final ACK, the side that initiated the close waits for twice the maximum segment lifetime, typically 60 seconds, in TIME_WAIT. It serves two purposes: it lets the final ACK be retransmitted if it was lost, so the peer is not stuck waiting, and it prevents delayed duplicate segments from an old connection being delivered into a new connection reusing the same four-tuple. It matters in practice because a busy client can exhaust ephemeral ports with sockets stuck in TIME_WAIT.

The sequence number labels the first byte of data in a segment, so the receiver can reassemble a stream that arrived out of order and discard duplicates. The acknowledgement number tells the sender the next byte the receiver expects, which cumulatively acknowledges everything before it. Both sides pick a random initial sequence number during the handshake, which makes it much harder for an attacker to inject data into an existing connection. Loss is detected when acknowledgements stop advancing or duplicates arrive.

Source and destination ports identify the endpoints, sequence and acknowledgement numbers provide ordering and reliability, and the data offset gives the header length. The flag bits SYN, ACK, FIN, RST, PSH and URG drive connection setup, teardown and control. The window size field carries flow control, the checksum protects the header and payload, and options carry extensions such as maximum segment size, window scaling, SACK and timestamps.

All three would rather drop data than wait for it. A retransmitted video frame or game position update arrives too late to be useful, so TCP retransmission and in-order delivery actively hurt: the stall is worse than the loss. DNS uses UDP because a query and response usually fit in one datagram, so paying for a three-way handshake would more than double the cost of the lookup. These applications add whatever reliability they need themselves, at the layer that understands the data.

MTU (Maximum Transmission Unit) is the largest frame payload a link can carry, typically 1500 bytes on Ethernet. MSS (Maximum Segment Size) is the largest amount of TCP payload in one segment, and is normally MTU minus the IP and TCP headers, so about 1460 bytes over IPv4 Ethernet. The two sides advertise their MSS during the handshake. Getting this wrong causes fragmentation or, worse, black-holed connections when path MTU discovery is broken by a firewall dropping ICMP.

If a packet is larger than the MTU of a link on its path, the router (in IPv4) may split it into fragments that are reassembled only at the final destination. It is avoided because losing any one fragment forces retransmission of the whole original packet, reassembly consumes memory and is a classic denial-of-service target, and many firewalls handle fragments badly. Modern practice is path MTU discovery with the Do Not Fragment bit set; IPv6 removes router fragmentation entirely and pushes it to the sender.

TCP delivers bytes strictly in order, so if one segment is lost, every segment that arrived after it sits in the receive buffer until the missing one is retransmitted. With HTTP/2, which multiplexes many streams over one TCP connection, a single lost packet therefore stalls every stream, not just the one it belonged to. This is the specific problem HTTP/3 solves by running over QUIC, where each stream is independently ordered so loss on one stream does not block the others.

ESTABLISHED means the handshake finished and data can flow. FIN_WAIT_1 and FIN_WAIT_2 are on the side that sent the first FIN, waiting for the acknowledgement and then the peer FIN. CLOSE_WAIT is on the side that received a FIN and has acknowledged it but has not yet closed its own end. A pile-up of sockets in CLOSE_WAIT is a strong signal of an application bug: the code is not calling close on sockets whose peer has already gone away.

Nagle reduces the number of tiny packets by holding small writes until either a full segment is ready or all previously sent data has been acknowledged. It saves bandwidth for interactive traffic like a terminal session, but it interacts badly with delayed acknowledgement and can add tens of milliseconds of latency to a small request-response exchange. Latency-sensitive protocols therefore set TCP_NODELAY to switch it off, and the usual real fix is to write the whole message in one call rather than several.

A checksum is a small value computed over a header or payload and carried alongside it, so the receiver can recompute it and detect corruption in transit. TCP and UDP checksums cover the header, the data and a pseudo-header containing the IP addresses, which also catches misdelivered packets. It detects accidental bit errors, not deliberate tampering, because an attacker can simply recompute it. Note that the UDP checksum is optional in IPv4 and mandatory in IPv6.

RST immediately aborts a connection rather than closing it gracefully. It is sent when a segment arrives for a port with no listening socket, when an application closes a socket that still has unread data, when a half-open connection receives unexpected data, or when a firewall actively rejects traffic. Seeing "connection reset by peer" means an RST arrived, which is a different failure from a timeout: RST is an explicit refusal, a timeout usually means packets are being silently dropped.

DNS (Domain Name System) translates human-readable domain names like example.com into IP addresses. When you request a name, the resolver checks local and browser caches first, then queries a recursive resolver, which walks the hierarchy: a root server points to the top-level domain server (such as .com), which points to the domain's authoritative name server, which returns the final IP. The answer is cached along the way based on its TTL so future lookups are faster.

A maps a name to an IPv4 address and AAAA to an IPv6 address. CNAME is an alias pointing one name at another name. MX names the mail servers for a domain with a priority. NS delegates a zone to its authoritative name servers, and SOA holds zone-wide settings such as the serial number and TTLs. TXT carries arbitrary text, which is how SPF, DKIM and domain verification work, and PTR does reverse lookups from IP back to name.

In a recursive query the client asks a resolver for the final answer and the resolver takes full responsibility for finding it. The resolver then performs iterative queries: it asks a root server, gets a referral to the TLD server, asks that, gets a referral to the authoritative server, and asks that for the record. So the client does one recursive query and the resolver does several iterative ones. The distinction matters because open recursive resolvers are widely abused for DNS amplification attacks.

TTL is the number of seconds any resolver is allowed to cache a record before asking again. A high TTL reduces query load and speeds up lookups; a low TTL means changes propagate quickly. Before migrating a service you lower the TTL well in advance, so that when you finally change the record the world picks it up in minutes rather than hours. The classic mistake is changing the IP first and only then noticing the TTL was set to a day.

An authoritative name server holds the actual zone data for a domain and gives the definitive answer for names it owns. A recursive resolver owns no zone data; it does the legwork of walking the hierarchy on behalf of clients and caches what it learns. Your ISP resolver, or a public one, is recursive; the name servers listed in a domain NS records are authoritative. An answer marked non-authoritative simply means it came from a resolver cache.

A reverse lookup maps an IP address back to a hostname using PTR records in the special in-addr.arpa zone for IPv4 or ip6.arpa for IPv6. It is used mainly for mail server reputation, logging and diagnostics: many mail receivers reject senders whose IP has no matching PTR record. It is not guaranteed to exist or to match the forward record, so it should never be relied on for authentication.

At several levels, checked in order: the browser has its own cache, the operating system has a stub resolver cache (and on many systems a hosts file consulted first), the local router or corporate resolver caches, and the ISP or public recursive resolver caches. Each level respects the record TTL. This layering is why a DNS change can appear live on one machine and stale on another, and why flushing only the browser cache often does not help.

A typical query and response fit in a single small datagram, so UDP avoids the handshake and gives an answer in one round trip. DNS falls back to TCP when the response is too large for the UDP limit, when the truncated bit is set, and for zone transfers between name servers, which are bulk and need reliability. DNS over TLS and DNS over HTTPS also use TCP because they are encrypted transports.

Cache poisoning is when an attacker gets a resolver to cache a forged record, so users of that resolver are silently sent to the wrong server. Classic defences are randomising the query ID and source port so the forgery is hard to guess in time. DNSSEC goes further by cryptographically signing records with a chain of trust from the root, so a resolver can verify a response really came from the zone owner. DNSSEC provides authenticity and integrity, not confidentiality, which is what DNS over HTTPS adds.

HTTP sends data in plain text, so anyone between the client and server can read or tamper with it. HTTPS is HTTP layered over TLS, which encrypts the traffic, verifies the server's identity with a certificate, and protects data integrity. HTTPS typically uses port 443 while plain HTTP uses port 80, and it is now the standard for any site handling sensitive information.

TLS (Transport Layer Security) is the protocol that encrypts HTTPS traffic; it is the successor to SSL. During the TLS handshake the client and server agree on a cipher suite, the server presents a certificate signed by a trusted certificate authority to prove its identity, and the two sides establish a shared session key, often using asymmetric cryptography to exchange it. After the handshake, the actual data is encrypted with fast symmetric encryption using that session key. This gives confidentiality, integrity, and authentication.

GET retrieves, POST creates or submits, PUT replaces a resource wholesale, PATCH updates part of it, DELETE removes it, HEAD is GET without a body, and OPTIONS reports what is allowed. GET, HEAD and OPTIONS are safe, meaning they should not change server state. GET, HEAD, PUT and DELETE are idempotent, meaning repeating them has the same effect as doing them once; POST and PATCH generally are not. Idempotency is what makes it safe for a client or proxy to retry a request.

1xx is informational, 2xx is success (200 OK, 201 Created, 204 No Content), 3xx is redirection (301 permanent, 302 temporary, 304 Not Modified), 4xx is a client error (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests), and 5xx is a server error (500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout). The 4xx versus 5xx split is the one interviewers probe: 4xx means retrying the identical request will not help.

GET asks for a resource and puts its parameters in the URL query string, so they are visible, logged, bookmarkable, length-limited and cached. POST sends data in the request body, which is not shown in the URL, has no practical size limit, and is not cached by default. GET is meant to be safe and idempotent while POST is neither, which is why a browser warns before re-submitting a POST. Neither is secure on its own; only HTTPS makes the data private.

Each HTTP request is handled independently and the server keeps no memory of previous requests from the same client. That is what lets any server in a pool answer any request, which is the basis of horizontal scaling. State is layered on top using cookies, session identifiers, tokens or hidden form fields. The trade-off is that every request must carry enough context to be understood on its own, which makes requests larger.

A cookie is a small key-value pair the server sets with a Set-Cookie header and the browser returns on subsequent requests to that domain. For sessions, the server stores the real state server-side and gives the browser only an opaque session ID in a cookie, which it looks up on each request. Important cookie attributes are HttpOnly, which hides it from JavaScript and blunts cross-site scripting, Secure, which restricts it to HTTPS, SameSite, which limits cross-site sending, plus Expires, Domain and Path.

A cookie is a storage mechanism in the browser; a session is a server-side concept representing one user interaction over time. The cookie usually holds nothing but the session identifier, while the actual data lives in server memory, a cache like Redis, or a database. Cookies are visible and modifiable by the user, so anything sensitive belongs in the session, not in the cookie. Sessions expire server-side, which is why logging out can invalidate a session even though the cookie still exists.

HTTP/1.1 sends one request at a time per connection, so browsers open six or more connections per host and still suffer head-of-line blocking. HTTP/2 adds binary framing, multiplexes many streams over one TCP connection, compresses headers with HPACK, and supports server push, but a single TCP loss still stalls every stream. HTTP/3 keeps the HTTP/2 semantics but runs over QUIC on UDP, giving per-stream ordering, faster connection setup and connection migration across networks.

QUIC is a transport protocol built on UDP that implements reliability, congestion control and TLS 1.3 encryption in user space rather than in the kernel TCP stack. Running over UDP was pragmatic: middleboxes across the internet will not pass a brand-new IP protocol, but they pass UDP. The benefits are a combined transport and crypto handshake that completes in one round trip (zero for resumption), independent streams that eliminate cross-stream head-of-line blocking, and connection IDs that let a session survive a change of IP address such as Wi-Fi to mobile.

A persistent connection reuses one TCP connection for multiple HTTP requests instead of opening and closing one per request. This matters because each new connection costs a three-way handshake, a TLS handshake, and restarts TCP slow start, so the first bytes on a fresh connection are always slow. Keep-alive is on by default in HTTP/1.1 and is signalled by the Connection header; HTTP/2 and HTTP/3 go further by multiplexing everything over a single connection.

The server controls caching with response headers: Cache-Control sets max-age, public or private, and no-store; ETag gives a content fingerprint and Last-Modified a timestamp. On a later request the browser sends If-None-Match or If-Modified-Since, and the server replies 304 Not Modified with no body if nothing changed, saving bandwidth. The usual production pattern is long max-age plus a content hash in the filename, so a new deploy changes the URL rather than needing cache invalidation.

Browsers enforce the same-origin policy, so a page on one origin cannot read responses from another origin by default; that is what stops a malicious page reading your webmail using your cookies. CORS (Cross-Origin Resource Sharing) is the controlled exception: the server opts in with Access-Control-Allow-Origin and related headers. Non-simple requests are preceded by an OPTIONS preflight to check the method and headers are allowed. Note it is enforced by the browser, not the server, so a CORS error never means the request was insecure at the network level.

TLS 1.2 takes two round trips: hello messages, then certificate and key exchange, then the finished messages. TLS 1.3 cuts this to one round trip by having the client guess the key-exchange group and send its key share in the very first message, and it supports zero round trip resumption for repeat visits. It also removes everything legacy and unsafe: RSA key transport, static Diffie-Hellman, CBC-mode and RC4 ciphers, compression and renegotiation. The result is that every TLS 1.3 handshake gives forward secrecy by default.

A certificate binds a public key to an identity such as a domain name, and is signed by a certificate authority. The server sends its leaf certificate plus any intermediates, and the client verifies each signature up to a root certificate already installed in its trust store. The client also checks the name matches, the validity dates, and revocation status. A missing intermediate is the most common cause of a certificate that works in one client and fails in another.

HSTS (HTTP Strict Transport Security) is a response header telling the browser to use HTTPS for this domain for a given period, so any later attempt to use plain HTTP is rewritten to HTTPS before a request is sent. It closes the window where a first plain-HTTP request could be intercepted and downgraded, which is what SSL stripping attacks exploit. The preload list goes further by shipping the domain inside the browser, so even the very first visit is protected.

An IP address is a numeric label that identifies a device on a network so packets can be routed to it. IPv4 addresses are 32 bits, written as four decimal numbers like 192.168.1.1, giving about 4.3 billion addresses. IPv6 addresses are 128 bits, written in hexadecimal groups, giving a vastly larger space to handle address exhaustion. IPv6 also simplifies the header and improves features like autoconfiguration.

Subnetting divides a large IP network into smaller logical sub-networks for better organization, security, and efficient address use. The subnet mask determines which part of an IP address is the network portion and which is the host portion, for example a /24 mask (255.255.255.0) reserves the first 24 bits for the network and the last 8 for hosts. CIDR notation like 10.0.0.0/16 expresses the mask as a prefix length. Devices use the mask to decide whether a destination is on the local subnet or must be sent to a router.

A public IP address is globally unique and routable on the internet, assigned to you by your ISP. A private IP address comes from reserved ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) that are used only inside local networks and are not routable on the public internet. Devices on a home or office network share private IPs internally and reach the internet through a single public IP using NAT.

Classful addressing split IPv4 by the leading bits: Class A covers 1 to 126 with a /8 default mask and huge host counts, Class B covers 128 to 191 with /16, and Class C covers 192 to 223 with /24. Class D (224 to 239) is reserved for multicast and Class E (240 and above) is experimental. Classes wasted enormous numbers of addresses, which is why CIDR replaced them in 1993, but interviewers still ask because the vocabulary persists.

CIDR (Classless Inter-Domain Routing) drops fixed class boundaries and writes the network prefix length explicitly, as in 192.168.10.0/22. That lets an organisation get an allocation sized to what it actually needs instead of jumping from 254 to 65,534 hosts. It also enables route aggregation, where one summarised prefix covers many smaller networks, which is the main reason the global routing table has stayed manageable.

A /26 leaves 6 host bits, giving 64 addresses in the block. Two are unusable for hosts: the all-zeros network address and the all-ones broadcast address, so 62 usable hosts. The general formula is 2 to the power of (32 minus prefix) minus 2. The exception worth mentioning is a /31, which by convention is used for point-to-point links with both addresses usable.

The network address is the first address in the block, with all host bits set to zero, and it identifies the subnet itself in routing tables. The broadcast address is the last, with all host bits set to one, and traffic sent to it goes to every host on that subnet. Neither can be assigned to a host, which is why every subnet loses two addresses. For 192.168.1.0/24 they are 192.168.1.0 and 192.168.1.255.

The default gateway is the router address a host sends packets to when the destination is not on its own subnet. The host applies its subnet mask to the destination IP; if it is local it uses ARP and sends directly, otherwise it frames the packet to the gateway MAC address. A wrong or missing gateway is the classic symptom where local machines ping fine but nothing outside the network is reachable.

127.0.0.1, or localhost, is the loopback address: traffic sent to it never leaves the machine and is handled by the loopback interface. The whole 127.0.0.0/8 range is reserved for this. It is used to talk to services on the same host and to test that the TCP/IP stack itself is working, which is why pinging it is the first step of the classic troubleshooting ladder. The IPv6 equivalent is ::1.

If a host is set to use DHCP but no DHCP server answers, it self-assigns an address from 169.254.0.0/16, known as APIPA in Windows or link-local generally. It allows communication with other hosts that did the same on the same segment, but there is no gateway and no internet access. Seeing a 169.254 address is therefore a direct diagnostic: the DHCP request failed, so check the cable, the VLAN or the DHCP server.

A static address is configured manually and does not change, which is what you want for servers, printers and network equipment that other machines must find at a known address. A dynamic address is leased by DHCP and may change between leases, which is right for laptops and phones where manual administration would not scale. A middle ground is a DHCP reservation, where the server always hands the same address to a given MAC, giving stability with central management.

Summarisation advertises one larger prefix that covers several contiguous smaller networks, so 10.1.0.0/24 through 10.1.3.0/24 become a single 10.1.0.0/22 advertisement. It shrinks routing tables, reduces the memory and CPU routers need, and contains the effect of a flapping link because the summary does not change when one component does. It requires the address plan to be contiguous and hierarchical, which is why sensible IP allocation matters before the network grows.

A hub is a simple Layer 1 device that broadcasts incoming data out of every port, which is inefficient and causes collisions. A switch operates at Layer 2 and uses MAC addresses to forward frames only to the specific port where the destination device is, so it is far more efficient within a local network. A router operates at Layer 3 and connects different networks together, using IP addresses to route packets between them, such as between your home network and the internet.

A MAC address is a permanent hardware identifier burned into a network interface, used for delivery within a local network segment at Layer 2. An IP address is a logical, assignable address used for routing across networks at Layer 3, and it can change as a device moves between networks. In short, the IP address identifies where a device is on the wider network, while the MAC address identifies the specific physical interface on the local link.

Switching moves frames within a single broadcast domain using MAC addresses at Layer 2; the switch learns which MAC lives on which port and forwards accordingly. Routing moves packets between different networks using IP addresses at Layer 3, choosing the next hop from a routing table and decrementing TTL. Roughly, switching is local delivery and routing is delivery across network boundaries. A Layer 3 switch blurs the line by doing both in hardware.

Each entry has a destination prefix, a next-hop address or outgoing interface, and a metric or administrative distance. When a packet arrives, the router matches its destination against every entry and uses longest prefix match, meaning the most specific matching prefix wins over less specific ones and over the default route 0.0.0.0/0. It then rewrites the Layer 2 header for the next hop, decrements the TTL, and forwards. The IP header itself is not otherwise changed, which is why the source and destination IP survive end to end.

Static routes are configured by hand: they are predictable, use no CPU or bandwidth, and reveal nothing about the topology, but they do not adapt when a link fails and do not scale past a small network. Dynamic routing protocols such as OSPF, EIGRP and BGP exchange information between routers, build routes automatically, and reconverge after a failure, at the cost of protocol overhead and complexity. Most real networks use dynamic routing internally with a static default route at the edge.

A distance-vector protocol such as RIP tells its direct neighbours everything it knows: each router shares its whole routing table with adjacent routers and picks the lowest hop count. A link-state protocol such as OSPF tells everyone what it knows about its own links: every router floods link-state advertisements, builds an identical map of the area, and runs Dijkstra to compute shortest paths itself. Link-state converges faster and avoids loops but uses more memory and CPU.

RIP is a distance-vector protocol that uses hop count as its only metric, broadcasts its table roughly every 30 seconds, and treats 16 hops as unreachable. Count-to-infinity happens when a network goes down and two routers keep learning the stale route back from each other, incrementing the metric one hop at a time until it finally reaches 16, which converges very slowly. The mitigations are split horizon, route poisoning with poison reverse, and hold-down timers.

OSPF is a link-state interior gateway protocol. Routers discover neighbours with hello packets, form adjacencies, flood link-state advertisements describing their own links, and each independently builds an identical link-state database. Every router then runs Dijkstra shortest-path-first over that database to compute its own routing table, using cost derived from bandwidth rather than hop count. It scales by dividing the network into areas that all connect to a backbone area 0, which limits how far flooding travels.

BGP is the path-vector protocol that autonomous systems use to exchange reachability between each other; it is what glues the internet together. Unlike interior protocols it does not pick the shortest path but the best path according to policy: local preference, AS path length, and business relationships between providers. It matters because it is trust-based, so a misconfigured or malicious announcement can hijack another organisation prefixes, which has caused several large internet outages.

A VLAN logically segments one physical switch infrastructure into multiple broadcast domains, so hosts in different VLANs cannot reach each other without going through a router or Layer 3 switch. It is used to separate traffic by function or trust level, such as guests, voice and servers, without buying separate hardware. It also limits the blast radius of broadcast traffic. Frames carry a VLAN tag (802.1Q) on trunk links between switches.

A collision domain is a segment where two transmissions can collide; hubs put every port in one collision domain, while each switch port is its own, which is why switches largely eliminated collisions. A broadcast domain is the set of devices that receive each other broadcasts; a switch forwards broadcasts everywhere, so a whole switch is one broadcast domain unless VLANs divide it. Routers do not forward broadcasts, so every router interface bounds a broadcast domain.

Layer 2 has no TTL, so a loop in a switched network causes broadcast frames to circulate forever and multiply, producing a broadcast storm that takes down the segment within seconds. STP prevents this by electing a root bridge and putting redundant links into a blocking state, leaving exactly one active path between any two points. If an active link fails, a blocked one is brought up. Rapid STP converges in seconds rather than the 30 to 50 seconds of the original.

A Layer 2 switch forwards frames using MAC addresses only and cannot move traffic between VLANs. A Layer 3 switch adds routing in hardware, so it can route between VLANs at close to wire speed without sending traffic to an external router. Compared with a traditional router it typically has far more ports and much less support for WAN interfaces and advanced routing features, so the pattern is Layer 3 switches inside the campus and routers at the edge.

ARP (Address Resolution Protocol) maps a known IP address to the MAC address needed to deliver a frame on a local network. When a device wants to send to an IP on its subnet but does not know the hardware address, it broadcasts an ARP request asking who owns that IP, and the matching device replies with its MAC address. The result is stored in an ARP cache so the lookup does not repeat for every packet.

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other network settings to devices when they join a network, removing the need for manual configuration. A client broadcasts a request and a DHCP server leases it an IP address along with the subnet mask, default gateway, and DNS servers. The process is often summarized as DORA: Discover, Offer, Request, and Acknowledge. Leases are temporary and renewed periodically.

ARP resolves a known IP to an unknown MAC. RARP did the reverse, letting a diskless host discover its own IP from its MAC, and has long been replaced by BOOTP and DHCP. Gratuitous ARP is an unsolicited ARP announcing your own IP-to-MAC mapping; it is used to update everyone caches after a failover moves a virtual IP to a new machine, and to detect duplicate addresses. It is also the mechanism ARP spoofing abuses.

ICMP is the control and error-reporting protocol of the IP layer. Routers and hosts use it to report problems such as destination unreachable, time exceeded when TTL hits zero, and fragmentation needed. It also carries echo request and echo reply, which is what ping uses, and time exceeded is what makes traceroute work. It carries no application data and has no ports, and blanket-blocking it at a firewall breaks path MTU discovery.

MTU is the largest payload a link will carry in one frame, typically 1500 bytes on Ethernet and 9000 on a jumbo-frame network. If an IPv4 packet is bigger and the Do Not Fragment bit is clear, a router fragments it; if that bit is set, the router drops it and returns an ICMP fragmentation needed message so the sender can lower its packet size. When a firewall blocks that ICMP message you get a PMTU black hole: small requests work and large ones hang, which is a classic hard-to-diagnose fault.

Half-duplex allows transmission in only one direction at a time, so the devices must take turns and collisions are possible; hubs and old shared Ethernet worked this way. Full-duplex allows both directions simultaneously on separate paths, doubling effective throughput and eliminating collisions entirely, which is what a modern switch port gives you. A duplex mismatch, where one side is full and the other half, produces late collisions and terrible throughput while the link still shows as up.

CSMA/CD (Collision Detection) is classic shared Ethernet: a station listens before transmitting, transmits if the medium is idle, and if it detects a collision it stops, sends a jam signal, and retries after an exponentially growing random backoff. It is obsolete on switched full-duplex links. CSMA/CA (Collision Avoidance) is used by Wi-Fi, where a station cannot listen while transmitting, so instead it waits a random interval, optionally exchanges RTS and CTS, and relies on explicit acknowledgements.

The sender computes a check value over the frame and appends it; the receiver recomputes and discards the frame if it does not match. A parity bit detects a single flipped bit but is weak. A checksum sums the data and is better but still misses some patterns. A cyclic redundancy check treats the frame as a polynomial and divides by a generator, catching all single-bit and burst errors up to the CRC length, which is why Ethernet uses a 32-bit CRC. These detect errors; correcting them is left to retransmission at a higher layer.

DHCP discovery uses a broadcast, and routers do not forward broadcasts, so a client on one subnet cannot reach a DHCP server on another. A relay agent, configured on the router interface as an IP helper, receives the broadcast, converts it to a unicast to the DHCP server, and adds the subnet information so the server picks the right scope. Without it you would need a DHCP server on every VLAN, which is exactly what you want to avoid in a large network.

The browser first resolves the domain name to an IP address using DNS, checking caches before querying a resolver. It then opens a TCP connection to the server, performing the three-way handshake and, for HTTPS, a TLS handshake to secure it. Next it sends an HTTP request, the server responds with the HTML, and the browser parses it and requests additional resources like CSS, JavaScript, and images. Finally the browser renders the page. Along the way packets are routed across networks using IP, with each hop guided by routers.

A socket is the operating system endpoint for network communication, identified by the combination of protocol, local IP, local port, remote IP and remote port. Applications read and write it much like a file descriptor, which is what lets the same code work over a network as over a pipe. A listening socket is only half specified (protocol, local IP and port); a connected socket is fully specified by the four-tuple, which is how one server port serves thousands of clients at once.

The server calls socket to create the endpoint, bind to attach it to an address and port, listen to mark it passive with a backlog queue, and then accept in a loop, which returns a new connected socket per client. The client calls socket and then connect, which triggers the three-way handshake. Both sides then send and recv until done, and call close. UDP skips listen, accept and connect entirely and uses sendto and recvfrom instead.

A blocking socket suspends the calling thread until the operation can proceed, which is simple but means one thread per connection and poor scaling. A non-blocking socket returns immediately, signalling that it would block, so the application uses a readiness API such as select, poll, epoll or kqueue to handle thousands of connections on one thread. This is the event-loop model behind Nginx and Node.js, and it is the standard answer to the C10K problem.

A WebSocket starts as an HTTP request with an Upgrade header and, once the server agrees with a 101 response, the same TCP connection becomes a persistent full-duplex channel with very small frame overhead. Polling repeatedly issues fresh HTTP requests, which wastes headers and adds latency equal to the polling interval; long polling improves latency but still costs a request per message. Use WebSocket when the server must push frequently, such as chat, live dashboards or multiplayer state.

A CDN is a globally distributed set of edge servers that cache your static content near users. It cuts latency because the round trip to a nearby edge is far shorter than to your origin, it absorbs load and traffic spikes so the origin serves only cache misses, and it terminates TLS at the edge so handshakes are fast. Most CDNs also provide DDoS absorption and image optimisation. The main operational concern is cache invalidation, usually solved by putting a content hash in asset filenames.

A load balancer distributes incoming requests across a pool of servers so no single one is overwhelmed, and removes failed servers from rotation via health checks. Common algorithms are round robin, weighted round robin for unequal hardware, least connections for long-lived sessions, and hashing on the client IP or a URL for cache affinity. A Layer 4 balancer routes on IP and port and is fast, while a Layer 7 balancer reads the HTTP request and can route by path, host or header.

A forward proxy sits in front of clients and makes requests on their behalf, which is used for corporate filtering, caching and anonymity; the client knows the proxy is there and the origin does not. A reverse proxy sits in front of servers and accepts requests on their behalf, which is used for load balancing, TLS termination, caching and hiding the internal topology; the client believes it is talking to the real server. Nginx, HAProxy and a CDN edge are reverse proxies.

Sticky sessions make a load balancer send every request from one client to the same backend, usually via a cookie or a source-IP hash, because that backend holds the session state in memory. The problem is that it breaks even distribution, prevents graceful draining, and loses sessions when a node dies or is redeployed. The better answer is to make servers stateless and move sessions into a shared store such as Redis, or into a signed token held by the client.

Latency is the time it takes for data to travel from source to destination, usually measured in milliseconds, and is often described as the delay. Bandwidth is the maximum amount of data that can be transferred per unit of time, such as megabits per second, and is described as capacity. A useful analogy is a pipe: bandwidth is how wide the pipe is, while latency is how long it takes water to travel through it. High bandwidth does not help if latency is high, and vice versa.

Bandwidth is the theoretical maximum a link can carry; throughput is the rate actually achieved in practice. Throughput is always lower because of protocol overhead, retransmissions, congestion, contention with other traffic and the limits of the slowest hop. Goodput is narrower still: only the useful application data, excluding headers and retransmissions. If an interviewer asks why a gigabit link only delivers 300 Mbps, this distinction is the answer they want.

Round-trip time is how long a packet takes to reach a destination and for the reply to come back, so it is roughly twice the one-way latency. Ping reports it directly using ICMP echo, and TCP measures it continuously to set its retransmission timeout. It matters because any protocol that needs handshakes pays a multiple of RTT before any data flows, which is exactly what TLS 1.3 and QUIC set out to reduce.

Jitter is variation in packet arrival time; packets sent evenly spaced arrive unevenly because of queuing and route changes. Real-time media needs a steady stream, so a receiver uses a jitter buffer that holds packets briefly and plays them out at a constant rate. The buffer costs latency, so there is a direct trade-off: a bigger buffer smooths more jitter but adds delay. High jitter shows up as choppy audio even when average latency and loss look fine.

Loss comes from congested router queues dropping packets, physical errors on wireless or damaged links, faulty hardware, and policing or rate limits. TCP treats it as a congestion signal and retransmits, so the visible effect is a throughput collapse rather than missing data, and even one percent loss can devastate throughput on a high-latency link. UDP applications see the loss directly and must conceal it, which is why a video call degrades in quality rather than stalling.

It is bandwidth multiplied by round-trip time, and it gives the amount of data that can be in flight on the path at any moment. If the TCP receive window is smaller than this, the sender must stop and wait for acknowledgements, so the connection cannot fill the pipe no matter how fast the link is. This is why the TCP window scaling option exists: without it the 64 KB window ceiling badly limits throughput on long fast paths such as intercontinental links.

Quality of Service is the set of mechanisms that give some traffic preferential treatment when the network is congested. Packets are classified and marked (with DSCP bits), then queued and scheduled so latency-sensitive traffic such as voice is served ahead of bulk transfers, with policing or shaping to cap greedy flows. It cannot create bandwidth; it only decides who suffers first when there is not enough. On an uncongested link, QoS changes nothing.

Congestion control prevents a sender from overwhelming the network and causing widespread packet loss. TCP infers congestion mainly from lost or delayed packets and adjusts how much data it sends using a congestion window. Classic algorithms include slow start, which ramps the window up exponentially at first, congestion avoidance, which then grows it linearly, and fast retransmit and fast recovery, which react to loss without dropping all the way back. This is distinct from flow control, which prevents overwhelming the receiver specifically.

Flow control protects the receiver: it stops a fast sender from overrunning a slow receiver buffer, and TCP implements it with the advertised receive window in every acknowledgement. Congestion control protects the network in between: it stops senders collectively overwhelming routers and links, and it is inferred from loss and delay rather than advertised. TCP sends the minimum of the receive window and the congestion window, so whichever constraint is tighter wins.

The sender may have up to one window worth of unacknowledged bytes in flight at any time. As acknowledgements arrive the window slides forward, allowing new data to be sent without waiting for a round trip per segment, which is what makes TCP fast on high-latency links. The receiver advertises its remaining buffer space in every acknowledgement, so the window shrinks when the application is slow to read and grows again when it catches up. A zero window pauses the sender until a window update arrives.

Stop-and-wait sends one frame and waits for its acknowledgement, which is simple but wastes almost the entire link on a high-latency path. Go-Back-N allows a window of unacknowledged frames but, on a loss, retransmits that frame and everything after it, so the receiver needs no buffer but bandwidth is wasted. Selective Repeat retransmits only the missing frame and buffers the out-of-order ones at the receiver, which is more efficient but needs more receiver memory and bookkeeping. TCP is closest to Selective Repeat, especially with SACK.

Slow start begins a connection with a small congestion window, typically ten segments, and doubles it every round trip until it reaches a threshold or a loss occurs, at which point congestion avoidance takes over with linear growth. It exists because a new sender knows nothing about the path capacity and blasting at full rate would cause immediate loss. It also restarts after an idle period or a timeout, which is a practical reason to keep connections warm rather than reopening them for each request.

Additive Increase Multiplicative Decrease is the control law behind TCP congestion avoidance: grow the window by roughly one segment per round trip when things are going well, and halve it on a loss. The asymmetry is deliberate. It is cautious about claiming capacity and aggressive about backing off, which mathematically drives competing flows toward a fair share of the bottleneck and keeps the network stable. It also produces the characteristic sawtooth throughput graph.

Basic TCP acknowledgements are cumulative, so they can only report the last contiguous byte received; if segments 2 and 5 of a burst are lost, the sender learns little about what actually arrived. SACK is a TCP option that lets the receiver list the non-contiguous blocks it holds, so the sender retransmits only the genuinely missing segments instead of everything after the first gap. It substantially improves recovery on paths with multiple losses per window.

It is a degenerate state where TCP ends up exchanging tiny segments, so the header overhead dwarfs the payload. It happens when a receiver advertises a small window as it frees a few bytes at a time, or when a sender transmits data one byte at a time as the application produces it. The receiver side is fixed by Clark solution, which advertises zero until a worthwhile amount of space is free, and the sender side by the Nagle algorithm, which coalesces small writes.

A port is a 16-bit number that identifies a specific application or service on a host, letting one IP address handle many connections at once; for example HTTP uses port 80, HTTPS uses 443, and SSH uses 22. NAT (Network Address Translation) lets many devices on a private network share a single public IP address: the router rewrites the source IP and port of outgoing packets and tracks the mapping so replies are returned to the correct internal device. NAT both conserves scarce public IPv4 addresses and adds a layer of isolation for the internal network.

Ports 0 to 1023 are well-known and reserved for standard services such as 22 for SSH, 25 for SMTP, 53 for DNS, 80 for HTTP and 443 for HTTPS; on Unix systems binding them requires elevated privilege. Ports 1024 to 49151 are registered for specific applications such as 3306 for MySQL and 5432 for PostgreSQL. Ports 49152 to 65535 are ephemeral and assigned temporarily by the operating system as the source port of an outgoing connection.

A firewall enforces a policy about which traffic may pass between networks. A packet-filtering firewall inspects each packet header independently against rules on address, port and protocol, which is fast but blind to context. A stateful firewall tracks connections, so it can allow return traffic for a connection it saw start, which is what almost all modern firewalls do. An application-layer or next-generation firewall inspects the payload itself, so it can distinguish HTTP traffic from something else tunnelled on port 443.

A VPN creates an encrypted tunnel across an untrusted network so that traffic between two points is confidential and authenticated, and the endpoint appears to be on the remote network. Packets are encapsulated inside encrypted packets, sent across the internet, decrypted at the far end and routed on. It is used for remote access to a private network, for connecting offices site to site, and for privacy on untrusted Wi-Fi. It protects the tunnel, not the endpoints, so it is not a substitute for host security.

IPsec works at the network layer, so it protects everything above it transparently and is the usual choice for permanent site-to-site tunnels; it needs a client and often has trouble crossing NAT and restrictive firewalls. An SSL or TLS VPN works at the transport layer on port 443, so it passes through almost any firewall and can run in a browser, which makes it the common choice for remote user access. IPsec is broader and more invasive; TLS is easier to deploy and more granular.

Symmetric encryption uses the same key to encrypt and decrypt, is very fast, and is what actually protects bulk data, but both parties must already share the key. Asymmetric encryption uses a public and private key pair, solving key distribution and enabling digital signatures, but it is orders of magnitude slower. Real protocols combine them: TLS uses asymmetric cryptography to authenticate the server and agree a session key, then encrypts the traffic symmetrically with that key.

A distributed denial of service floods a target with traffic from many compromised machines so legitimate users cannot get through. Volumetric attacks saturate bandwidth, protocol attacks such as SYN floods exhaust connection state, and application-layer attacks issue expensive requests at modest rates. Mitigation combines upstream scrubbing or a CDN that absorbs volume, rate limiting and connection limits, SYN cookies, anycast to spread the load geographically, and autoscaling so capacity is not fixed.

An attacker sends a stream of SYN packets, often with spoofed source addresses, and never completes the handshake. Each one consumes an entry in the server half-open connection queue until the queue is full and genuine connections are refused. The standard defence is SYN cookies: the server encodes the connection state into the initial sequence number it returns and allocates nothing until a valid final ACK comes back, so there is no queue to exhaust. Shorter SYN timeouts and larger backlogs help but do not solve it.

An attacker positions itself between two parties, relaying and possibly altering their traffic while each believes it is talking directly to the other. Common vectors are ARP spoofing on a LAN, a rogue Wi-Fi access point, DNS poisoning and BGP hijacking. The defence is authenticated encryption: TLS with proper certificate validation means the attacker cannot present a trusted certificate for the domain. This is why certificate warnings must never be clicked through, and why HSTS and certificate pinning exist.

IP spoofing means forging the source address of a packet so it appears to come from somewhere else. It is used to hide the origin of an attack, to bypass address-based access controls, and above all to make reflection and amplification attacks work, since the response goes to the victim rather than the attacker. It is hard to abuse for a TCP conversation because the attacker never sees the returned sequence numbers. The main defence is ingress and egress filtering, where providers drop packets with source addresses that cannot legitimately come from that link.

ARP has no authentication, so any host can send an unsolicited ARP reply claiming to own an IP address. An attacker claims to be the default gateway, so victims send their traffic through the attacker machine, which is the standard way to set up a man-in-the-middle on a LAN. Defences are dynamic ARP inspection on managed switches, DHCP snooping, static ARP entries for critical hosts, and, most importantly, end-to-end encryption so intercepted traffic is useless.

Port forwarding configures a NAT router to send inbound traffic arriving on a chosen public port to a specific private IP and port inside the network. It is how you expose a home server or a game server through a router that otherwise blocks unsolicited inbound connections. It is also a real security exposure, because it deliberately punches a hole in the isolation NAT provides, so the exposed service must be patched and authenticated properly.

A DMZ is a separate network segment holding the services that must be reachable from the internet, such as web and mail servers, sitting between the internet and the internal LAN with a firewall on each side. The point is containment: if a public-facing server is compromised, the attacker is in the DMZ and still has to cross a firewall to reach internal systems. Traffic rules are asymmetric, with the internal network allowed to initiate into the DMZ but not the reverse.

Ping sends ICMP echo request packets to a host and reports the echo replies, giving round-trip time and packet loss. It answers two questions: is the host reachable at the IP layer, and how healthy is the path. It does not test whether an application is running, so a service can be completely broken while ping is perfect. A failed ping is also not proof of a dead host, because many hosts and firewalls simply drop ICMP.

Traceroute lists the routers along the path to a destination with the latency at each hop. It works by sending packets with TTL set to 1, then 2, and so on; each router that decrements the TTL to zero returns an ICMP time exceeded message, revealing its address. Unix traceroute uses UDP by default and Windows tracert uses ICMP. Read it for the hop where latency jumps and stays high; a single slow hop that later hops do not inherit is usually just a router deprioritising ICMP, not a real problem.

Netstat lists network connections, listening sockets, routing tables and interface statistics. In practice you use it to check whether a service is actually listening and on which interface, to see the state of connections, and to find which process owns a port. Piles of connections in TIME_WAIT or CLOSE_WAIT are the two patterns worth recognising. On modern Linux the faster replacement is ss, and lsof or netstat with the process flag maps a port to a PID.

Both query DNS directly rather than relying on the operating system resolver, so you can see exactly what a name server returns. You use them to check which IP a name resolves to, to inspect specific record types such as MX or TXT, and to query a particular server so you can compare a resolver cache against the authoritative answer. Dig gives fuller output including the TTL, flags and which section each record came from, which is what you want when diagnosing a propagation problem.

They report the local network configuration: interface addresses, subnet mask, default gateway, and with the full flag the DNS servers, DHCP server and lease times. It is the first thing to check when a machine cannot reach anything, because it immediately reveals a 169.254 self-assigned address, a missing gateway or a wrong mask. On modern Linux the maintained equivalent is the ip command, as in ip addr and ip route.

Ping only proves IP-layer reachability to the host. The failure can be at any layer above: the web server process is down or listening on the wrong interface, a firewall permits ICMP but blocks port 443, TLS negotiation fails because of an expired or mismatched certificate, DNS returns the wrong address so you are pinging a different machine than the browser reaches, or the application itself returns a 5xx. Working up the layers in that order is exactly the answer interviewers want.

A packet capture with tcpdump or Wireshark records the actual frames on the wire, so you can see precisely what was sent and received rather than what you believe was. Use it when logs disagree with reality: to confirm whether a SYN was answered, whether a TLS handshake failed and with which alert, whether retransmissions are inflating latency, or whether a request left the machine at all. Capture with a filter and on the right interface, and remember that captures of encrypted traffic show the handshake and timing but not the payload.

Telnet or netcat to a host and port tells you whether a TCP connection can be established at all, which cleanly separates a network or firewall problem from an application problem. Netcat is the better tool because it also handles UDP, listening, and piping data. Curl goes one layer higher and performs a full HTTP request, with verbose mode showing DNS resolution, the TCP connection, the TLS handshake and the response headers, which is usually enough to identify the failing stage in one command.

Start by reproducing it and deciding whether the delay is in name resolution, connection setup, time to first byte or content download, which curl timing output or the browser network panel shows directly. A slow DNS lookup points at the resolver, a slow connect or TLS handshake points at latency, path or certificate chain problems, a slow time to first byte points at the application or database, and a slow download points at bandwidth, packet loss or asset size. Then check whether it is universal or regional, which separates an origin problem from a routing or CDN problem.