Computer Networks

# Computer Networks Interview Questions — Complete Notes

Source set: all 35 questions from the InterviewBit Networking PDF (answered here in my own words, expanded with diagrams/examples), reorganized by topic instead of the original sequential order, plus extra topics that commonly come up in networking interviews/coursework but weren't in that PDF (3-way handshake mechanics, flow/congestion control, switching techniques, NAT, device hierarchy, CIDR/subnetting math, IPv6, error detection).

---

📑 Table of Contents#

• [[#1. Network Fundamentals & Types]]
• [[#2. Network Topology]]
• [[#3. OSI & TCP/IP Reference Models]]
• [[#4. Addressing — IP & MAC]]
• [[#5. Core Transport & Network Layer Protocols]]
• [[#6. Application Layer Protocols]]
• [[#7. Networking Devices & Hardware]]
• [[#8. VPN, NAT & Security]]
• [[#9. Transmission Types, Switching & The Big Picture]]
• [[#10. Quick-Fire Revision Table]]

Legend: 🟩 = from the original PDF (re-explained in my own words) · 🟦 = added by me, common in interviews/coursework but not in the original set.

---

1. Network Fundamentals & Types#

🟩 Q1 & Q2. How are network types classified? Different types of networks

Networks are primarily classified by the geographical area they span:

PAN (1m) < LAN (building) < MAN (city) < WAN (country/continent) < GAN (global)

[!tip] Interview Angle Q: Is "the Internet" a WAN or a GAN? A: Strictly, the Internet is described as a GAN/Global Area Network — it's literally a network of WANs, connecting WAN-scale networks together globally. Casually, people often just call it "the world's largest WAN," but the precise classification puts it one level above, as a network connecting networks.

---

🟩 Q3. LAN (Local Area Network) in detail

A LAN connects computers and devices within a single building or nearby area, enabling resource sharing (printers, file servers) and fast local communication. When owned/used by a company, it's called an enterprise network.

• Wired LAN — uses Ethernet cables, connected through a switch.
• Wireless LAN (WLAN) — uses Wi-Fi via an access point, no cabling needed — popular wherever running physical cable is impractical.

codeCopy
Wired LAN:                          Wireless LAN:
[PC1] [PC2] [PC3]                   [Laptop] [Phone] [Laptop]
   \    |    /                          \      |      /
   [Ethernet Switch] ── rest of network   [Access Point] ── To Wired Network

---

🟩 Q7. Nodes and Links

• Node — any device capable of sending/receiving data on a network: computers, printers, servers, modems, routers.
• Link — the connection between two nodes, defined by its medium (wired/wireless) and the protocol governing communication over it.

[Node: PC] ──link (Ethernet cable)── [Node: Switch] ──link (fiber)── [Node: Router]

---

🟩 Q30. Subnet

A subnet is a smaller network carved out of a larger network via subnetting — splitting one big address block into multiple smaller ones. Benefits: better routing efficiency (routers can make decisions based on smaller, more specific address ranges instead of scanning a giant flat table), improved security (isolating segments from each other), and reduced broadcast traffic (broadcasts stay within their own subnet rather than flooding the whole network).

codeCopy
Big network: 192.168.0.0/24  (256 addresses)
        │
   Subnetted into 4 smaller subnets:
192.168.0.0/26   192.168.0.64/26   192.168.0.128/26   192.168.0.192/26
 (64 addrs each)

[!tip] Interview Angle Q: Why would a company subnet its internal network instead of running everything as one flat /16 or /24? A: Flat networks have one giant broadcast domain — every broadcast (ARP requests, DHCP discovery, etc.) reaches every device, which gets noisy and wastes bandwidth as the network grows. Subnetting breaks that into smaller broadcast domains (e.g. one subnet per department/floor), confines broadcast traffic, lets you apply different security policies per subnet, and makes routing tables more efficient since routes can be aggregated by subnet.

---

🟦 Bonus — CIDR & Subnet Mask Math

A subnet mask (or CIDR notation like /24) marks which bits of an IP address are the network portion vs the host portion.

codeCopy
IP Address:    192.168.1.10
Subnet Mask:   255.255.255.0   (= /24, meaning the first 24 bits are network bits)

Network portion: 192.168.1.0   (identifies the subnet itself)
Host portion:           .10     (identifies this specific device within the subnet)

Number of usable hosts in a /24 = 2^8 - 2 = 254
                                   (subtract: 1 for network address, 1 for broadcast address)

Quick CIDR-to-hosts reference:

[!tip] Interview Angle Q: Why does a /24 subnet only give you 254 usable host addresses instead of 256? A: The first address in the range (e.g. .0) is reserved as the network address (identifies the subnet itself, not an actual host) and the last address (e.g. .255) is reserved as the broadcast address (sends to every host on that subnet) — neither can be assigned to an individual device, so 2 of the 256 total addresses are always unusable for hosts.

---

2. Network Topology#

🟩 Q8 & Q9. Network Topology & Types

Network topology is the physical (or logical) layout describing how nodes and links are arranged and connected.

codeCopy
Bus:        ●──●──●──●            Star:        ●
                                              ╱ │ ╲
                                            ●  ●  ●

Ring:    ●───●                    Mesh:    ●───●
         │   │                            ╱│╲ ╱│╲
         ●───●                           ● │ ●  │●
                                            ╲│╱
                                             ●

Tree:        ●
           ╱ │ ╲
         ●   ●   ●        <- each of these could itself be the center of its own small star
        ╱│╲
       ● ● ●

[!tip] Interview Angle Q: Why is Star topology the dominant choice for home/office LANs despite the central node being a single point of failure? A: A modern switch (the central node) is highly reliable and cheap relative to the benefits: failures are isolated to one device's link rather than cascading (unlike Bus or Ring, where one bad cable/node can take the whole network down), and troubleshooting is trivial — you can see exactly which port/cable is having issues. The single-point-of-failure risk is small and well-understood compared to the operational simplicity gained.

---

3. OSI & TCP/IP Reference Models#

🟩 Q12 & Q13. OSI Reference Model — 7 Layers

The OSI (Open System Interconnection) model is a conceptual 7-layer framework (ISO standard) describing how data moves from one device to another across a network — each layer has a well-defined function and hands off to the layer below/above it.

Mnemonic (top to bottom): "All People Seem To Need Data Processing" (Application, Presentation, Session, Transport, Network, Data Link, Physical).

codeCopy
 Application   ┐
 Presentation  │  Software Layers (deal with data meaning/format)
 Session       ┘
 Transport     ←  considered the "heart" of OSI — end-to-end reliability
 Network       ┐
 Data Link     │  Hardware Layers (deal with actually moving bits)
 Physical      ┘

---

🟩 Q14 & Q15. TCP/IP Reference Model — 4 Layers

The TCP/IP model is a more practical, compressed 4-layer model (developed by the US DoD) that the actual Internet is built on — named after its two most foundational protocols.

---

🟩 Q16. OSI vs TCP/IP

codeCopy
OSI:        Application → Presentation → Session → Transport → Network → Data Link → Physical
                                ↓ (Presentation & Session not modeled separately)
TCP/IP:     Application  ──────────────────────→ Transport → Internet → Link

[!tip] Interview Angle Q: If the Internet actually runs on TCP/IP, why do interviews still ask about the 7-layer OSI model? A: OSI is primarily a teaching and troubleshooting framework — its strict layer boundaries make it easier to reason about where a networking problem lives ("is this a Layer 2 switching issue or a Layer 3 routing issue?") even though the real Internet's actual implementation (TCP/IP) doesn't separate Presentation/Session as cleanly. It's a conceptual map, not the literal blueprint of what's running.

🟦 Bonus — Layer-by-layer "what breaks if this layer fails" intuition

A common interview framing is mapping a real symptom to the OSI layer it lives at:

---

4. Addressing — IP & MAC#

🟩 Q10. IPv4 Address & Classes

An IPv4 address is a 32-bit address (4 octets of 8 bits each, written as 4 numbers 0-255 separated by dots, e.g. 192.168.1.10) uniquely identifying a device on a network.

IPv4 classes (classful addressing, based on the first octet):

[!warning] Gotcha Classful addressing (A/B/C/D/E) is largely a legacy concept today — modern networks use CIDR (Classless Inter-Domain Routing) notation (/24, /16, etc.) instead, which allows far more flexible, efficient allocation than being locked into fixed class boundaries. Interviews still ask about classes because they're foundational/historical, but real-world subnet design today is classless.

🟩 Q11. Private & Special IP Addresses

Private IP ranges (non-routable on the public Internet, reserved for internal/LAN use):

Special address: 127.0.0.1 – 127.255.255.255 is the loopback range — used for a device to refer to itself (network testing without touching real network hardware).

[!tip] Interview Angle Q: Why can two completely different home networks both use 192.168.1.1 for their router without conflict? A: Private IP ranges are only meaningful within their own local network — they're not routable on the public Internet at all, so the same private address can be reused independently across millions of separate private networks worldwide without any collision. NAT (covered in Section 8) is what translates between these private addresses and a single public-facing address when traffic actually leaves the local network.

---

🟩 Q28 & Q29. MAC Address & NIC, MAC vs IP Address

A MAC (Media Access Control) address is a 48-bit (or 64-bit) globally unique identifier physically burned into a device's NIC (Network Interface Card) — the hardware component that lets a device physically connect to a network. It operates at the Data Link layer (Layer 2).

[!tip] Interview Angle Q: Why does a network need both a MAC address AND an IP address — isn't one enough? A: They solve different problems at different layers. The IP address is logical and hierarchical — it tells routers which network/subnet to send a packet toward, and changes depending on where a device is connected. The MAC address is the physical, flat identifier used for the actual last-hop delivery within a local network segment (Ethernet/Wi-Fi) — ARP (Section 6) is the protocol that bridges the two, resolving "I know the IP, what's the MAC to actually deliver this frame to?"

🟦 Bonus — IPv6 (brief)

IPv4's 32-bit address space (~4.3 billion addresses) ran out as Internet-connected devices exploded — IPv6 uses 128-bit addresses instead, written as 8 groups of 4 hex digits (e.g. 2001:0db8:85a3:0000:0000:8a2e:0370:7334), providing an astronomically larger address space (effectively eliminating the need for NAT for address-conservation purposes, though NAT is still used for other reasons like security).

[!tip] Interview Angle Q: If IPv6 has been around for decades, why does most traffic still use IPv4? A: Backward compatibility and migration cost — IPv4 and IPv6 aren't directly interoperable, so the transition requires dual-stack support (running both simultaneously) across ISPs, routers, and endpoints worldwide, which is a massive, slow-moving coordination problem. NAT also extended IPv4's practical lifespan far longer than its raw address space would otherwise have allowed, reducing the urgency.

---

5. Core Transport & Network Layer Protocols#

🟩 Q21, Q22 & Q23. TCP vs UDP

TCP (Transmission Control Protocol) — connection-oriented, reliable. Establishes a connection via a three-way handshake before any data flows, guarantees ordered delivery, and retransmits lost packets.

UDP (User Datagram Protocol) — connectionless, unreliable but fast. No handshake, no guaranteed order or delivery, no built-in error recovery — just "fire and forget," which makes it much lower-overhead.

[!tip] Interview Angle Q: Why does DNS use UDP when reliability seems important for something as critical as resolving domain names? A: DNS queries are small, single-request-response exchanges where the cost of occasionally retrying a lost query (handled at the application level by simply re-querying) is far cheaper than paying TCP's connection-setup overhead on every single lookup. Speed matters more than guaranteed delivery here — and DNS does fall back to TCP for larger responses (e.g. zone transfers) where reliability matters more.

🟦 Bonus — The TCP Three-Way Handshake (in detail)

TCP doesn't just "use a handshake" — here's exactly what happens to establish a connection:

codeCopy
Client                                    Server
  │ ────────── SYN (seq=x) ───────────────►  │   "I want to connect, my starting sequence number is x"
  │ ◄───── SYN-ACK (seq=y, ack=x+1) ───────  │   "OK, acknowledged. My starting sequence number is y"
  │ ────────── ACK (ack=y+1) ──────────────►  │   "Acknowledged, connection established"
  │                                           │
  │ <<<<<<<<<<< data can now flow >>>>>>>>>  │

1. SYN — client sends a synchronize packet with an initial sequence number.
2. SYN-ACK — server acknowledges and sends its own sequence number back.
3. ACK — client acknowledges the server's sequence number — connection is now established.

Connection termination (4-way handshake / FIN sequence):

codeCopy
Client                                    Server
  │ ─────────── FIN ───────────────────────►  │  "I'm done sending"
  │ ◄────────── ACK ────────────────────────  │  "Acknowledged"
  │ ◄────────── FIN ────────────────────────  │  "I'm done too"
  │ ─────────── ACK ───────────────────────►  │  "Acknowledged, fully closed"

[!tip] Interview Angle Q: Why does TCP need a 3-way handshake specifically — why not 2 steps? A: Both sides need to confirm both that they can send to the other and that the other can send back — a 2-step handshake only proves one direction works. Step 1 (SYN) proves client→server works once server receives it; step 2 (SYN-ACK) proves server→client works once client receives it; step 3 (ACK) confirms back to the server that its SYN-ACK was received, completing mutual confirmation in both directions before any real data is risked.

🟦 Bonus — Flow Control & Congestion Control

• Flow control — prevents a fast sender from overwhelming a slow receiver. TCP uses a sliding window: the receiver advertises how much buffer space it has left, and the sender won't send more than that until acknowledged data frees up room.
• Congestion control — prevents a fast sender from overwhelming the network itself (not just the receiver) — addressing the broader problem of too much traffic on shared links. TCP's classic approach: Slow Start (begin with a small congestion window, double it each round-trip until packet loss is detected) followed by Congestion Avoidance (linear growth, back off sharply on loss) — together these are often summarized as AIMD (Additive Increase, Multiplicative Decrease).

[!tip] Interview Angle Q: Flow control vs congestion control — aren't they the same thing? A: No — flow control is about one specific receiver's buffer capacity (a local, end-to-end concern between exactly two hosts); congestion control is about the shared network path's overall capacity (a global concern involving every router/link along the way, which neither endpoint can directly see, only infer from packet loss/delay).

---

🟩 Q24. ICMP Protocol

ICMP (Internet Control Message Protocol) operates at the Network layer and is used for error reporting and diagnostics rather than carrying actual application data — routers use it to report problems (e.g. "destination unreachable," "TTL expired") back to the sender. The classic tools ping and traceroute are built directly on ICMP.

[!tip] Interview Angle Q: How does traceroute actually use ICMP to map the path to a destination? A: It sends a series of packets with progressively increasing TTL (Time To Live) values (1, 2, 3...) — each router along the path decrements TTL by 1, and when it hits 0, that router drops the packet and sends back an ICMP "TTL exceeded" message identifying itself. By sending TTL=1, then TTL=2, then TTL=3, etc., traceroute gets one ICMP reply per hop, building up the full path one router at a time.

🟦 Bonus — Ports & Sockets

A port is a 16-bit number identifying a specific process/service on a device (0-65535) — it's how multiple applications on the same IP address can each have their own independent communication channel. A socket is the combination of IP address + port + protocol, uniquely identifying one specific endpoint of a network connection.

codeCopy
Socket = IP Address + Port
192.168.1.10:443  →  this specific machine, talking on the HTTPS port

Well-known ports: 20/21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 67/68 (DHCP), 80 (HTTP), 443 (HTTPS).

---

6. Application Layer Protocols#

🟩 Q17. HTTP & HTTPS

HTTP (HyperText Transfer Protocol) — defines the rules for transmitting data on the web between browsers and servers. It's stateless (each request is independent, no memory of previous requests by default), runs on port 80, built on top of TCP.

HTTPS (HTTP Secure) — HTTP layered with SSL/TLS encryption — encrypts the communication and verifies server identity via certificates. Runs on port 443.

[!tip] Interview Angle Q: HTTP is "stateless" — so how do websites keep you logged in across page loads? A: Statelessness is handled around, not violated — servers issue a session token/cookie on first login, the browser automatically attaches it to every subsequent request's headers, and the server looks up that token to recognize "this is the same logged-in user" — the protocol itself still treats every request independently; the application layer on top reconstructs continuity using that token.

🟩 Q18. SMTP

SMTP (Simple Mail Transfer Protocol) governs how email is transmitted between mail servers (not how a user retrieves it — that's POP3/IMAP, see bonus below). Supports end-to-end and store-and-forward delivery. Listens on port 25 by default.

Sender ──SMTP──► Internet ──SMTP──► Mail Server ──POP3/IMAP──► Receiver

🟩 Q19. DNS

DNS (Domain Name System) is the Internet's decentralized, hierarchical directory translating human-readable domain names into IP addresses (e.g. interviewbit.com → 172.217.166.36). Uses port 53.

[!tip] Interview Angle Q: Why is DNS described as "hierarchical"? A: Resolution happens in stages, top-down — a query for www.example.com goes from a root server → TLD server (handles .com) → authoritative server for example.com, each level only knowing about the level directly below it rather than the whole Internet's mappings. This hierarchy is what lets DNS scale globally without any single server needing to know every domain in existence.

🟦 Bonus — Common DNS Record Types

---

🟩 Q25. DHCP

DHCP (Dynamic Host Configuration Protocol) auto-assigns IP addresses and network configuration (subnet mask, default gateway, DNS server) to devices joining a network, so they don't need manual configuration. Uses port 67 (server) / 68 (client).

[!tip] Interview Angle Q: What actually happens, step by step, when your laptop connects to a new Wi-Fi network and gets an IP? A: The classic DORA sequence: Discover (client broadcasts "is any DHCP server here?"), Offer (a DHCP server responds with a proposed IP + config), Request (client formally requests that specific offer), Acknowledge (server confirms and the lease begins) — all done via broadcast since the client doesn't have an IP yet to communicate directly.

🟩 Q26. ARP

ARP (Address Resolution Protocol) resolves a known IP address (logical, Network layer) into the corresponding MAC address (physical, Data Link layer) needed to actually deliver a frame on a local network segment.

codeCopy
"I know your IP is 192.168.1.5, but what's your MAC address?"  ← ARP request (broadcast)
"My MAC is AA:BB:CC:DD:EE:FF"                                    ← ARP reply (unicast back)

🟩 Q27. FTP

FTP (File Transfer Protocol) is used to reliably transfer files between hosts — supports both uploading and downloading. (Note: standard FTP commonly uses ports 20/21 for data/control in most implementations; the PDF cites port 27, which is non-standard — worth double-checking before quoting a port number confidently in an interview.)

🟦 Bonus — Telnet, SSH, POP3 & IMAP

• Telnet — remote terminal access protocol, sends everything (including passwords) in plaintext — essentially obsolete for anything security-sensitive today.
• SSH (Secure Shell) — the modern, encrypted replacement for Telnet, used for secure remote login and command execution (port 22).
• POP3 (Post Office Protocol v3) — downloads email from a server to one device, typically removing it from the server afterward (mailbox lives locally).
• IMAP (Internet Message Access Protocol) — keeps email synced on the server, accessible identically from multiple devices (mailbox lives on the server) — this is why IMAP is the standard for anyone checking email from more than one device.

[!tip] Interview Angle Q: Why has Telnet been almost entirely replaced by SSH? A: Telnet transmits all data — including login credentials — as plaintext over the network, meaning anyone intercepting the traffic (packet sniffing on a shared network) can read passwords directly. SSH encrypts the entire session, making it the only reasonable choice for any remote access over an untrusted network (which is effectively all networks today).

---

7. Networking Devices & Hardware#

🟩 Q20. Router vs Gateway

A router connects two or more network segments and directs traffic between them, operating at the Network layer — but it generally connects networks using the same underlying protocol stack.

A gateway also routes/regulates traffic, but specifically connects dissimilar networks — networks running different protocols entirely (e.g. bridging a corporate network to a completely different external system). Every gateway can act like a router, but a plain router can't necessarily bridge protocol differences the way a gateway can.

[!tip] Interview Angle Q: Is your home Wi-Fi "router" actually just a router? A: Functionally, most consumer "routers" are several devices in one box: a router (routes between your LAN and the ISP's network), a switch (the LAN ports), a wireless access point (Wi-Fi), and often also acts as a default gateway for your home network (the device your devices send traffic to when the destination isn't on the local network) — "router" is the marketing name for what's really a multi-function device.

---

🟩 Q31. Hub vs Switch

[!tip] Interview Angle Q: Why did switches almost entirely replace hubs in modern networks? A: A hub treats every connected device as sharing one big collision domain — broadcasting every bit it receives out every other port regardless of the actual destination, which both wastes bandwidth and increases collisions as more devices are added. A switch actually learns which MAC address lives on which port and forwards frames intelligently only where they need to go, dramatically improving both efficiency and effective throughput as the network grows.

🟦 Bonus — Full Device Hierarchy (Repeater → Gateway)

From "dumbest" to "smartest," roughly by OSI layer:

🟦 Bonus — Collision Domain vs Broadcast Domain

• Collision Domain — a set of devices where a transmission from one can collide with a transmission from another (only relevant for shared, half-duplex media). Each switch port is its own collision domain; a hub puts everything connected to it in one shared collision domain.
• Broadcast Domain — a set of devices that all receive each other's broadcast traffic. A switch does not separate broadcast domains (a broadcast still reaches every port) — only a router (or VLAN configuration) separates broadcast domains.

[!tip] Interview Angle Q: Does adding more switches to a network reduce broadcast traffic? A: No — switches forward broadcasts out every port (that's the definition of a broadcast), so no matter how many switches you chain together, they all remain part of the same broadcast domain. Only routing (or VLANs, which create logically separate broadcast domains even on shared switch hardware) actually contains broadcast traffic.

---

🟩 Q32. ipconfig vs ifconfig

[!tip] Interview Angle Q: What's the modern Linux replacement for ifconfig, and why does it matter? A: ip (e.g. ip addr, ip link) — ifconfig is deprecated on most modern Linux distributions in favor of the iproute2 suite, which supports more modern networking features (like multiple IPs per interface, advanced routing) that the older net-tools-based ifconfig wasn't designed for. Worth knowing both, since ifconfig still appears constantly in older docs/scripts.

---

8. VPN, NAT & Security#

🟩 Q4, Q5 & Q6. VPN — What it is, Advantages, Types

A VPN (Virtual Private Network) creates an encrypted "tunnel" over the public Internet, letting a remote client connect securely to a private network as if it were physically on that network.

Advantages:

• Cheaper than dedicated private WAN links between offices.
• Secure, encrypted transfer of confidential data between locations.
• Protects organizational data against interception/intrusion.
• Disguises online identity/location by routing traffic through the VPN's IP.

Types:

• Access VPN — connects individual remote/mobile users to an organization's network; cheaper alternative to old dial-up/ISDN.
• Site-to-Site VPN — connects entire office networks to each other (Router-to-Router):
  • Intranet VPN — connects an organization's own remote offices together.
  • Extranet VPN — connects an organization's network to external parties (suppliers, partners, customers) over shared infrastructure.

codeCopy
Office A (Perth) ──┐
                     ├── Internet (encrypted VPN tunnels) ── Office B (Brisbane)
Office C (Melbourne)─┘

[!tip] Interview Angle Q: Does a VPN make your traffic anonymous? A: Not entirely — it hides your traffic and real IP from sites you visit (which see the VPN server's IP instead) and encrypts traffic from your local network/ISP's view, but the VPN provider itself can typically see your real traffic unless additional measures are used. "Private" here means private from outside observers along the path, not anonymous in an absolute sense.

---

🟩 Q33. Firewall

A firewall monitors and filters incoming/outgoing network traffic based on a defined set of security rules/policies, acting as a barrier between a trusted private network and an untrusted public network (the Internet). Can be hardware, software, or both.

Internet ──(unwanted traffic blocked)──► [FIREWALL] ──(allowed traffic)──► Private Network

[!tip] Interview Angle Q: Is a firewall the same thing as antivirus software? A: No — a firewall controls which network traffic is allowed to enter/leave based on rules (IP addresses, ports, protocols) — it doesn't inspect file contents for malware. Antivirus inspects files/processes on a device for known malicious code/behavior. They're complementary: a firewall can block a malicious connection attempt entirely, while antivirus catches a malicious file that got through (e.g. via email attachment) by other means.

🟦 Bonus — NAT (Network Address Translation)

NAT translates private IP addresses (used inside a LAN) into a single public IP address (or small pool) when traffic leaves the network toward the Internet — and translates responses back to the correct internal device. This is what lets dozens of devices on a home network share one public IP address from the ISP.

codeCopy
[Laptop 192.168.1.10] ─┐
[Phone  192.168.1.11] ─┼── [Router/NAT] ──► Internet, all appearing as ──► Public IP: 203.0.113.5
[TV     192.168.1.12] ─┘

NAT keeps a translation table mapping each internal (private IP + port) to a unique (public IP + port) pair, so return traffic gets routed back to the correct internal device.

[!tip] Interview Angle Q: Is NAT a security feature, or just an address-conservation trick? A: Primarily address conservation (it's the main reason IPv4's limited address space lasted as long as it has) — but it has an incidental security side-effect: devices behind NAT aren't directly addressable from the public Internet (no inbound connection can reach them without explicit port-forwarding configured), which provides a basic layer of obscurity. It's not a substitute for an actual firewall, though — it's a side benefit, not its design purpose.

🟦 Bonus — Proxy Server

A proxy server sits between a client and the wider Internet, forwarding requests on the client's behalf — the destination server sees the proxy's IP rather than the original client's. Used for: caching frequently-requested content, content filtering (blocking certain sites at a company/school), anonymizing client IPs, and load distribution.

[!tip] Interview Angle Q: Proxy vs VPN — when would you use one over the other? A: A proxy typically operates at the application level (often just redirecting specific traffic like HTTP) and usually doesn't encrypt traffic by default — good for content filtering/caching/IP masking for a specific app. A VPN encrypts and tunnels all traffic at a lower network level, system-wide, which is what you'd want for genuine security/privacy across an entire device's network activity, not just one app's requests.

---

9. Transmission Types, Switching & The Big Picture#

🟩 Q34. Unicasting, Anycasting, Multicasting, Broadcasting

codeCopy
Unicast:    A ──────► B
Anycast:    A ──────► (whichever of B, C, D is closest)
Multicast:  A ──┬───► B
                ├───► C
                (not D)
Broadcast:  A ──┬───► B
                ├───► C
                └───► D   (everyone)

[!tip] Interview Angle Q: How does anycast routing decide which of several identical servers to send a request to? A: The same IP address is announced from multiple physical locations via BGP routing, and the network's normal routing decisions (typically based on the shortest/cheapest path, which usually correlates with network proximity) naturally direct each client to whichever announcing location is "closest" in routing terms — this is exactly how CDNs route users to a nearby edge server without the client needing to know multiple server addresses.

🟦 Bonus — Simplex, Half-Duplex, Full-Duplex

• Simplex — one-way only (e.g. a TV broadcast — data flows from the broadcaster to you, never back).
• Half-Duplex — both directions possible, but not simultaneously (e.g. old walkie-talkies — only one party transmits at a time).
• Full-Duplex — both directions simultaneously (e.g. a phone call, modern Ethernet/switch connections).

---

🟩 Q35. What happens when you enter google.com in a browser?

This is the classic "walk me through the whole stack" interview question — a great chance to demonstrate end-to-end understanding:

1. Browser cache check — if a fresh, cached copy of the page already exists, it's shown immediately (no network trip at all).
2. DNS resolution — if the IP for google.com isn't already cached (browser or OS level), the OS performs a DNS lookup (via UDP) to translate the domain name into an IP address.
3. TCP connection — a new TCP connection is established between browser and server via the three-way handshake (Section 5).
4. TLS handshake (for HTTPS) — certificates are exchanged and verified, encryption keys negotiated, before any HTTP data is sent.
5. HTTP request sent — the browser sends an HTTP(S) request over the established TCP connection.
6. Server processes & responds — the web server handles the request (often involving application servers, databases, etc.) and sends back an HTTP response.
7. Browser processes the response — may keep the TCP connection alive for further requests (e.g. for images/CSS/JS) or close it; caches the response if cacheable.
8. Rendering — the browser parses HTML/CSS/JS and renders the page on screen.

codeCopy
Browser cache? ──no──► DNS lookup (UDP) ──► TCP 3-way handshake ──► TLS handshake (HTTPS)
                                                                          │
Page rendered ◄── Browser parses response ◄── Server responds ◄── HTTP(S) request sent

[!tip] Interview Angle Q: Where in this whole flow does the actual three-way handshake from Section 5 fit, and why does it happen before the HTTP request rather than as part of it? A: It happens at Step 3, strictly before any application-layer data is exchanged — TCP must establish a reliable, ordered channel first (Transport layer concern) before HTTP (Application layer) can even begin sending its request on top of it. This is a direct, concrete illustration of why the OSI/TCP-IP layering from Section 3 actually matters in practice: each layer's job genuinely has to complete before the layer above it can do its job.

🟦 Bonus — Switching Techniques

How data actually moves through intermediate network nodes from source to destination:

• Circuit Switching — a dedicated physical path is reserved for the entire duration of the communication (like a traditional telephone call). Guarantees consistent bandwidth, but wastes capacity when the line is idle and doesn't scale well for bursty data traffic.
• Packet Switching — data is broken into packets, each routed independently (potentially via different paths) and reassembled at the destination. Far more efficient for typical Internet traffic (bursty, variable), used by virtually the entire modern Internet — but doesn't guarantee a fixed bandwidth/latency the way circuit switching does.
• Message Switching — an entire message is sent as one whole unit, stored and forwarded hop-by-hop (store-and-forward) without needing a dedicated end-to-end path — largely a historical/legacy approach, conceptually a predecessor to packet switching.

[!tip] Interview Angle Q: Why is the Internet built on packet switching rather than circuit switching? A: Internet traffic is bursty and unpredictable (a web page load isn't a continuous steady stream like a phone call) — circuit switching's fixed dedicated path would waste huge amounts of reserved capacity during idle moments. Packet switching lets many flows share the same physical links efficiently, with packets from different conversations interleaved on demand — at the cost of variable latency/no hard bandwidth guarantee, which is an acceptable trade-off for almost all Internet traffic except things like traditional landline telephony.

🟦 Bonus — Bandwidth vs Throughput vs Latency

• Bandwidth — the theoretical maximum data rate a link can support (e.g. "a 1 Gbps connection").
• Throughput — the actual data rate achieved in practice, which is often lower than bandwidth due to overhead, congestion, or protocol inefficiencies.
• Latency — the delay before data starts arriving (time for a single bit/packet to travel from source to destination) — independent of bandwidth; a high-bandwidth, high-latency link (e.g. satellite Internet) can still feel "slow" for interactive tasks even though it can move a lot of data per second once it gets going.

[!tip] Interview Angle Q: Could a connection have high bandwidth but still feel sluggish for something like online gaming? A: Yes — gaming is latency-sensitive (you need quick round-trip responses for input/reaction), not bandwidth-sensitive (the actual data per action is tiny). A satellite connection might offer high bandwidth (good for streaming/downloads) but have very high latency (signal has to travel to a satellite and back), making it feel laggy for real-time interaction despite plenty of "speed" on paper.

---

10. Quick-Fire Revision Table#

One-liner recall — good for a last-pass scan before an interview. Full explanations are in the sections above.

---

Coverage Note#

All 35 questions from the InterviewBit Networking PDF are answered above (marked 🟩), rewritten in my own words/structure with added diagrams/examples — not copied from the source, and reorganized into 9 logical themes instead of the original sequential numbering. Everything marked 🟦 is additional material covering topics that come up often in networking interviews and coursework but weren't in the original 35 — most notably: the mechanics of the TCP three-way handshake/termination, flow vs congestion control, CIDR/subnet math, the full networking device hierarchy, collision vs broadcast domains, NAT, switching techniques, and IPv6.

Suggested next step: the "what happens when you enter google.com" question (Q35) is one of the most common whole-stack interview questions across networking AND full-stack roles — practice walking through it out loud, naming the protocol and OSI/TCP-IP layer active at each step, since that's usually what separates a memorized answer from a genuinely understood one.