Networking Interview Questions and Answers

A computer network is a collection of interconnected devices that communicate and exchange data using standardised communication protocols. It enables devices such as computers, servers, smartphones, and IoT devices to share information and resources efficiently over wired or wireless connections.

1. What are network devices? Explain their types.

Network devices are hardware components that connect computers and other devices in a network. They enable data to be transmitted, received, and managed between connected devices. These devices ensure efficient, reliable, and secure communication across local and wide-area networks.

• Connect multiple devices to form a computer network.
• Control and direct the flow of data between devices.
• Improve network communication, performance, and connectivity.

2. What are the different types of computer networks?

A computer network is a collection of interconnected devices that share data and resources. Based on the area they cover, networks are classified into different types. The main types are PAN, LAN, MAN, and WAN.

• PAN (Personal Area Network): Covers a small area around a person.
• LAN (Local Area Network): Connects devices within a home, school, or office.
• MAN (Metropolitan Area Network): Connects multiple LANs across a city.
• WAN (Wide Area Network): Connects networks over large geographical areas, such as the Internet.

3. Name of the software layers or User support layer in the OSI model.

• Application layer - Provides network services directly to end-user applications.
• Presentation layer - Translates, encrypts, and compresses data for the application layer.
• Session layer - Establishes, manages, and terminates communication sessions between devices.

4. Name the hardware layers or network support layers in the OSI model.

• Network layer - Determines the best path and routes packets between networks.
• Datalink layer - Ensures reliable data transfer between directly connected devices using frames and MAC addresses.
• Physical layer - Transmits raw bits over the physical transmission medium such as cables or wireless signals.

5. What is a network topology? Explain its types.

A network topology is the physical or logical arrangement of devices in a computer network. It defines how devices are connected and how data is transmitted between them. A proper network topology improves communication, performance, and reliability..

• Bus Topology: All devices are connected to a single shared cable (backbone).
• Star Topology: All devices are connected to a central hub or switch.
• Ring Topology: Devices are connected in a circular loop, where data travels from one device to the next.
• Mesh Topology: Every device is connected to one or more other devices, providing multiple communication paths.
• Tree Topology: A hierarchical topology that combines multiple star networks connected through a central backbone.

6. Explain the OSI model, its seven layers, the devices used at each layer, and how it differs from the TCP/IP model.

The OSI (Open Systems Interconnection) model is a 7-layer reference model that standardizes network communication between devices. Each layer performs a specific function, and different networking devices operate at different layers. The TCP/IP model is a 4-layer practical model that is widely used for Internet communication.

• The OSI model consists of 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.
• Devices used include Hub/Repeater (Physical), Switch/Bridge (Data Link), Router (Network), and Gateway/Firewall (Transport–Application).
• OSI is a reference model with 7 layers, whereas TCP/IP is a practical model with 4 layers.

7. What happens to a data packet as it moves through the OSI model?

As a data packet moves through the OSI model, it passes through all seven layers. At the sender's side, each layer adds its own header to the data, while at the receiver's side, each layer removes the corresponding header. These processes ensure reliable communication between devices.

• Encapsulation: Each layer adds its own header as data moves from the Application layer to the Physical layer.
• Decapsulation: Each layer removes its corresponding header as data moves from the Physical layer to the Application layer.
• These processes help ensure accurate and reliable data transmission across the network.

8. What is a VPN ? Explain its types.

A VPN (Virtual Private Network) creates a secure and encrypted connection over the Internet, allowing users to safely access a private network. It protects data during transmission and enables secure communication between users or networks. VPNs are commonly used for remote access and secure networking.

• Provides a secure and encrypted connection over the Internet.
• Protects data and enables safe remote access.
• Used by individuals and organizations for secure communication.

Types of VPN

1. Remote Access VPN

• Connects individual users to a private network over the Internet.
• Commonly used by employees working remotely.

2. Site-to-Site VPN

• Connects two or more private networks over the Internet.
• It is of two types:
  1. Intranet VPN: Connects branches of the same organization.
  2. Extranet VPN: Connects an organization with partners or customers.

9. Explain the TCP three-way handshake and why TCP uses three handshakes instead of two.

The TCP three-way handshake is the process used to establish a reliable connection between a client and a server before data transmission begins. It ensures that both devices are ready to communicate and can exchange data reliably. The connection is established using three steps: SYN, SYN-ACK, and ACK.

• Step 1 (SYN): The client sends a SYN packet to request a connection.
• Step 2 (SYN-ACK): The server replies with a SYN-ACK packet to acknowledge the request.
• Step 3 (ACK): The client sends an ACK packet, completing the connection.

Why Does TCP Use Three Handshakes Instead of Two?

The third ACK confirms that the client has received the server's response.

• It ensures that both client and server are ready for communication.
• It prevents duplicate or delayed connection requests from creating invalid connections.

10. Explain TCP connection termination, the TIME_WAIT state, and what happens if the final ACK is lost.

TCP connection termination uses a four-way handshake because each direction of communication is closed independently. The client and server exchange FIN and ACK packets to close the connection gracefully. After sending the final ACK, the client enters the TIME_WAIT state to ensure reliable connection termination.

• TCP Connection Termination: The client sends FIN, the server replies with ACK, then sends FIN, and the client responds with the final ACK.
• TIME_WAIT State: The client waits for a short period to allow delayed packets to expire and to retransmit the final ACK if required.
• If the Final ACK is Lost: The server retransmits its FIN, and the client sends the ACK again before both sides close the connection.

11. What are TCP sequence numbers and acknowledgment numbers? How do they prevent duplicate packets?

TCP sequence numbers identify the position of each byte of data sent by the sender, while acknowledgment numbers indicate the next byte the receiver expects. Together, they ensure reliable and ordered data transmission. They also help detect missing and duplicate packets.

• Sequence Number: Identifies the position of each byte in the transmitted data.
• Acknowledgment Number: Indicates the next byte expected by the receiver.
• Prevents Duplicate Packets: TCP discards packets with sequence numbers that have already been received, ensuring reliable and ordered communication.

12. Explain TCP retransmission, Retransmission Timeout (RTO), Fast Retransmit, and Fast Recovery.

TCP retransmission is the process of resending lost packets to ensure reliable data delivery. A packet is retransmitted either when the Retransmission Timeout (RTO) expires or when Fast Retransmit detects packet loss through duplicate ACKs. Fast Recovery helps maintain network performance by avoiding a complete restart of congestion control.

• Retransmission Timeout (RTO): Retransmits a packet if an acknowledgment is not received within the calculated timeout period.
• Fast Retransmit: Retransmits a lost packet immediately after receiving three duplicate ACKs, without waiting for the RTO.
• Fast Recovery: Continues data transmission after packet loss without restarting from Slow Start, improving performance.

13. What is the difference between the congestion window (cwnd) and the receive window (rwnd)?

The congestion window (cwnd) and receive window (rwnd) control the amount of data a sender can transmit. The cwnd is managed by the sender based on network congestion, while the rwnd is managed by the receiver based on available buffer space. The sender transmits data up to the smaller of the two values.

• Congestion Window (cwnd): Controlled by the sender to avoid network congestion.
• Receive Window (rwnd): Advertised by the receiver based on available buffer space.
• Data Sent = min(cwnd, rwnd): The sender can transmit only up to the smaller of these two windows.

14. Explain TCP congestion control, including Slow Start, Congestion Avoidance, and AIMD.

TCP congestion control prevents network congestion by adjusting the amount of data sent over the network. It begins with Slow Start, switches to Congestion Avoidance as the network stabilizes, and uses AIMD (Additive Increase Multiplicative Decrease) to respond to congestion. This improves network efficiency and reliability.

• Slow Start: Increases the congestion window (cwnd) exponentially to quickly utilize available bandwidth.
• Congestion Avoidance: Increases cwnd linearly after reaching the threshold to avoid congestion.
• AIMD: Gradually increases cwnd during normal operation and reduces it significantly when packet loss is detected.

15. What is Explicit Congestion Notification (ECN)? How does it improve network performance?

Explicit Congestion Notification (ECN) is a TCP congestion control mechanism that allows routers to mark packets instead of dropping them when congestion is detected. The receiver notifies the sender about the marked packets, and the sender reduces its transmission rate before packet loss occurs. This improves network efficiency and reduces unnecessary retransmissions.

• ECN marks packets instead of dropping them when congestion begins.
• The sender reduces its transmission rate after receiving the congestion notification.
• Advantages: Improves throughput, reduces retransmissions, and lowers network latency.

16. Compare Tahoe, Reno, New Reno, and Cubic TCP

TCP Tahoe, Reno, New Reno, and Cubic are congestion control algorithms used to improve network performance. Each algorithm differs in how it detects packet loss and recovers from congestion. Newer algorithms provide faster recovery and better utilization of network bandwidth.

• Tahoe: Uses Slow Start and Fast Retransmit, but always restarts from Slow Start after packet loss.
• Reno & New Reno: Recover faster using Fast Recovery.
• Cubic: Uses a cubic window growth function for better performance in high-speed and long-distance networks.

17. How does TCP distinguish between packet loss caused by congestion and wireless transmission errors?

Traditional TCP assumes that all packet losses are caused by network congestion and reduces its transmission rate. However, in wireless networks, packets may also be lost due to signal interference or transmission errors. Modern TCP uses advanced mechanisms to better identify the cause of packet loss and improve performance.

• Traditional TCP treats all packet losses as a sign of congestion.
• Wireless packet loss can occur due to signal interference or transmission errors.
• Modern TCP uses ECN, SACK, and link-layer error recovery to distinguish the cause of packet loss and improve performance.

18. Why is congestion control important in TCP?

Congestion control prevents the network from becoming overloaded with excessive data traffic. It allows TCP to adjust its transmission rate according to current network conditions. This ensures efficient bandwidth utilization, reliable communication, and stable network performance.

• Prevents packet loss, network delays, and router congestion.
• Adjusts the congestion window (cwnd) based on network conditions.
• Improves bandwidth utilization, fairness, and overall network stability.

19. Compare Stop-and-Wait, Go-Back-N, and Selective Repeat protocols.

Stop-and-Wait, Go-Back-N, and Selective Repeat are Automatic Repeat reQuest (ARQ) protocols used to ensure reliable data transmission. They differ in how they send data frames and handle packet loss. Selective Repeat is the most efficient because it retransmits only the lost frames.

• Stop-and-Wait: Simple but less efficient.
• Go-Back-N: Improves efficiency by allowing multiple outstanding frames.
• Selective Repeat: Most efficient because it retransmits only lost frames.

20. Why must the Selective Repeat window size be at most half the sequence number space?

Selective Repeat ARQ, both the sender and receiver maintain separate windows for reliable communication. If the window size is greater than half of the sequence number space, old delayed packets may be mistaken for new packets with the same sequence number. Limiting the window size prevents this ambiguity and ensures correct packet delivery.

• Both the sender and receiver maintain separate transmission windows.
• A window larger than half the sequence number space can cause old and new packets to have the same sequence number.
• Limiting the window size to half the sequence number space prevents ambiguity and ensures reliable communication.

21. What is the Bandwidth-Delay Product (BDP), and How Does Pipelining Improve Network Performance?

The Bandwidth-Delay Product (BDP) is the amount of data that can be in transit before an acknowledgment is received. It is calculated as Bandwidth × Round-Trip Time (RTT). Pipelining improves performance by allowing multiple packets to be transmitted without waiting for acknowledgments.

• BDP = Bandwidth × RTT.
• A higher BDP allows more data to be in transit.
• Pipelining improves bandwidth utilization and reduces idle time.

22. Compare Distance Vector and Link-State Routing Protocols

Distance Vector and Link-State are routing protocols used to determine the best path for data transmission. Distance Vector shares routing information with neighboring routers, while Link-State maintains a complete network map. Link-State protocols converge faster and are better suited for large networks.

• Distance Vector: Simple but slower convergence.
• Link-State: Faster and more scalable.
• Examples: RIP (Distance Vector), OSPF (Link-State).

23. Why Does RIP Suffer from the Count-to-Infinity Problem, and How Do Split Horizon and Route Poisoning Solve It?

The count-to-infinity problem occurs when routers continuously increase the hop count for an unreachable destination, creating routing loops. Split Horizon prevents routes from being advertised back on the interface from which they were learned. Route Poisoning marks failed routes with an infinite metric to quickly inform neighboring routers.

• Count-to-infinity creates routing loops.
• Split Horizon prevents routes from being advertised back to the source.
• Route Poisoning marks failed routes as unreachable.

24. Why Does OSPF Converge Faster Than RIP? Explain the Dijkstra Algorithm Used in OSPF.

OSPF converges faster than RIP because it uses a Link-State approach and updates only changed routing information. It maintains a complete network map and applies the Dijkstra (Shortest Path First) algorithm to calculate the shortest path. This enables faster and more efficient routing.

• OSPF uses the Link-State routing method.
• Uses Dijkstra's Shortest Path First (SPF) algorithm.
• Converges faster by updating only changed information.

25. Explain BGP and Why It Is Called a Path-Vector Protocol.

Border Gateway Protocol (BGP) is used to exchange routing information between different Autonomous Systems (AS) on the Internet. It advertises the complete AS path for each route, helping prevent routing loops and apply routing policies. Therefore, BGP is called a path-vector protocol.

• Used for routing between different Autonomous Systems (AS).
• Advertises the complete AS path of a route.
• Prevents routing loops and supports routing policies.

26. What are CIDR (Route Aggregation) and Equal-Cost Multi-Path (ECMP), and Why Are They Useful?

CIDR (Classless Inter-Domain Routing) combines multiple network prefixes into a single route to reduce routing table size. Equal-Cost Multi-Path (ECMP) distributes traffic across multiple paths with equal routing cost. Together, they improve scalability, bandwidth utilization, and reliability.

• CIDR: Reduces routing table size through route aggregation.
• ECMP: Balances traffic across multiple equal-cost paths.
• Improves scalability, performance, and reliability.

27. Differentiate Between Interior Gateway Protocols (IGPs) and Exterior Gateway Protocols (EGPs)

IGPs are routing protocols used within a single Autonomous System (AS), while EGPs exchange routing information between different Autonomous Systems. RIP and OSPF are examples of IGPs, whereas BGP is the most common EGP.

28. Why Are Private IP Addresses Not Routable on the Internet?

Private IP addresses are reserved for use within local networks and are not globally unique. Internet routers do not forward these addresses over the public Internet. To access the Internet, private IP addresses must be translated into public IP addresses using Network Address Translation (NAT).

• Private IP addresses are used only in local networks.
• Internet routers do not route private IP addresses.
• NAT converts private IP addresses into public IP addresses for Internet communication.

29. Explain NAT and its limitations.

Network Address Translation (NAT) is a technique that converts private IP addresses into public IP addresses, allowing multiple devices to share a single public IP. It helps conserve IPv4 addresses, improves security by hiding internal network details, and reduces the need for public IP addresses. However, NAT can complicate peer-to-peer communication, VoIP, online gaming, and some applications that require direct end-to-end connectivity.

30. Why Does IPv6 Eliminate the Need for NAT?

IPv6 uses 128-bit addresses, providing a vast number of unique IP addresses. This allows every device to have its own public IP address, eliminating the need for Network Address Translation (NAT). As a result, end-to-end communication becomes simpler and more efficient.

• Provides a 128-bit address space with a huge number of IP addresses.
• Allows every device to have a unique public IP address.
• Eliminates NAT, improving communication and network performance.

31. Explain IPv6 Neighbor Discovery and How It Replaces ARP

Neighbor Discovery Protocol (NDP) is an IPv6 protocol that replaces ARP used in IPv4. It uses ICMPv6 messages to discover neighboring devices, resolve IPv6 addresses to MAC addresses, and identify routers. NDP also supports automatic address configuration.

• Replaces ARP in IPv6.
• Uses ICMPv6 for address resolution and router discovery.
• Supports automatic address configuration and duplicate address detection.

32. Compare CIDR and VLSM

CIDR and VLSM both use classless addressing but serve different purposes. CIDR combines multiple networks into one route, while VLSM divides a network into subnets of different sizes. Both improve efficient IP address usage.

33. How Does a Switch Learn MAC Addresses, and What Happens with an Unknown Destination MAC Address?

A switch learns MAC addresses by reading the source MAC address of incoming frames and storing it in its MAC address table. If the destination MAC address is unknown, the switch floods the frame to all ports except the incoming port. After receiving a reply, it updates its MAC table.

• Learns MAC addresses from the source MAC address.
• Stores MAC addresses in the MAC address table.
• Floods frames with unknown destination MAC addresses.

34. Explain the Spanning Tree Protocol (STP) and the Role of the Root Bridge

Spanning Tree Protocol (STP) is a Layer 2 protocol that prevents switching loops by creating a loop-free network topology. It elects one switch as the Root Bridge, which serves as the reference point for selecting the shortest path. Backup paths are activated automatically if the active path fails.

• Prevents switching loops in Layer 2 networks.
• Elects one switch as the Root Bridge.
• Activates backup paths if the primary path fails.

35. What is VLAN Tagging (IEEE 802.1Q), and Why Is It Used?

VLAN tagging is defined by the IEEE 802.1Q standard and adds a VLAN identifier to Ethernet frames. It allows multiple VLANs to share the same physical network while keeping their traffic separate. This improves network security and management.

• Adds a VLAN ID to Ethernet frames.
• Allows multiple VLANs over a single trunk link.
• Improves security and network efficiency.

36. Why Is DNS Hierarchical Instead of Centralized?

DNS uses a hierarchical structure to improve scalability, reliability, and performance. It distributes domain information among Root, TLD, and Authoritative DNS servers instead of relying on one central server. This reduces server load and eliminates a single point of failure.

• Improves scalability and reliability.
• Uses Root, TLD, and Authoritative DNS servers.
• Reduces server load and avoids a single point of failure.

37. Explain What Happens When You Enter a URL in a Browser

When a URL is entered, the browser first resolves the domain name using DNS. It then establishes a TCP connection and performs a TLS handshake if HTTPS is used. Finally, it sends an HTTP request, receives the webpage, and renders it.

• Resolves the domain name using DNS.
• Establishes a TCP/TLS connection.
• Downloads and displays the webpage.

38. Why Does HTTPS Use TLS Instead of Plain HTTP?

HTTPS uses TLS (Transport Layer Security) to encrypt communication between the client and server. During the TLS handshake, certificates are verified and encryption keys are generated. This ensures secure communication, unlike plain HTTP, which sends data in readable text.

• Encrypts data using TLS.
• Verifies the server through digital certificates.
• Ensures confidentiality, integrity, and authentication.

39. Compare HTTP/1.1, HTTP/2, and HTTP/3

HTTP/1.1, HTTP/2, and HTTP/3 are different versions of the HTTP protocol. Each version improves speed and efficiency over the previous one. HTTP/3 provides the best performance by using the QUIC protocol over UDP.

40. Why Does ICMP Not Use TCP?

ICMP (Internet Control Message Protocol) is a Network Layer protocol used for error reporting and diagnostics. It does not use TCP because it sends small control messages rather than application data. Using TCP would add unnecessary connection overhead.

• Used for error reporting and diagnostics.
• Operates at the Network Layer.
• Does not require TCP's connection and reliability features.

41. Compare Packet Switching and Circuit Switching

Circuit switching creates a dedicated communication path before data transfer begins, while packet switching divides data into packets that travel independently. Packet switching is preferred for the Internet because it efficiently shares network resources and adapts to congestion. ( Circuit Switching vs Packet Switching )

42. What are MTU and Path MTU Discovery (PMTUD)?

MTU (Maximum Transmission Unit) is the largest packet size that can be transmitted without fragmentation. Path MTU Discovery (PMTUD) identifies the smallest MTU along the communication path. This reduces fragmentation and improves network performance.

• MTU defines the maximum packet size.
• PMTUD finds the smallest MTU along the path.
• Reduces fragmentation and improves efficiency.

43. Why Is UDP Preferred for Streaming and Online Gaming Despite Being Unreliable?

UDP (User Datagram Protocol) is preferred for real-time applications because it offers low latency and minimal overhead. It does not establish a connection or retransmit lost packets, allowing faster communication. Small packet losses are acceptable in streaming and online gaming.

• Provides low latency and fast communication.
• Does not retransmit lost packets.
• Ideal for streaming, VoIP, and online gaming.

44. Differentiate between Bluetooth, Wi-Fi, and ZigBee.

• Bluetooth: A short-range, low-power wireless technology used to connect personal devices like headphones, keyboards, and smartphones.
• Wi-Fi: A high-speed wireless networking technology used to provide internet access and connect devices over a local network.
• ZigBee: A low-power, low-data-rate wireless technology designed for IoT devices, sensor networks, and home automation.

45. What are Symmetric and Asymmetric Encryption?

Symmetric and Asymmetric Encryption are techniques used to secure data during transmission. Symmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses two different keys: a public key and a private key. Asymmetric encryption is more secure but slower.

46. What is the Main Purpose of a DNS Server?

A DNS (Domain Name System) server translates domain names into IP addresses and vice versa. This allows users to access websites using easy-to-remember names instead of numerical IP addresses. DNS makes Internet communication simpler and more efficient.

• Converts domain names into IP addresses.
• Helps users access websites using domain names.
• Maintains domain name and IP address mapping.

47. What are the Advantages of Fiber Optics?

Fiber optic cables transmit data using light signals, providing faster and more reliable communication than copper cables. They support long-distance communication with minimal signal loss. Fiber optics are also secure and resistant to interference.

• High bandwidth and faster data transmission.
• Supports long-distance communication with low signal loss.
• Immune to electromagnetic interference (EMI) and more secure.

48. Can IP Multicast Be Load-Balanced?

IP multicast is not load-balanced because traffic from a single source follows only one network path. Although multiple paths may exist, multicast traffic is not distributed across them. This ensures consistent delivery to all receivers.

• IP multicast traffic uses only one path.
• Does not distribute traffic across multiple paths.
• Ensures consistent multicast delivery.

49. What is CGMP (Cisco Group Management Protocol)?

CGMP (Cisco Group Management Protocol) is a Cisco protocol that helps switches manage multicast traffic. Routers send CGMP messages, and switches use them to determine which ports should receive multicast packets. This reduces unnecessary multicast traffic.

• Used to manage multicast traffic.
• Routers send CGMP messages; switches process them.
• Reduces unnecessary multicast packet flooding.

50. Why Do We Need the POP3 Protocol for E-mail?

POP3 (Post Office Protocol version 3) is used to download emails from a mail server to a user's device. Once downloaded, emails can be read even without an Internet connection. It is widely supported by email clients.

• Downloads emails from the mail server.
• Allows offline access to downloaded emails.
• Supported by most email applications.

51. Define the Term Jitter

Jitter is the variation in the delay of data packets during transmission. High jitter can affect real-time applications such as voice calls and video streaming. It is measured in milliseconds (ms).

• Variation in packet delivery delay.
• Affects voice and video quality.
• Measured in milliseconds (ms).

52. Why Is Bandwidth Important to Network Performance?

Bandwidth is the maximum amount of data that can be transmitted over a network in a given time. Higher bandwidth allows more data to be transferred, improving network performance. However, overall speed also depends on latency.

• Determines the data transfer capacity.
• Higher bandwidth supports faster communication.
• Network performance also depends on latency.

53. How to Get an IP Address from a Domain Name?

An IP address can be obtained from a domain name using command-line tools such as ping or nslookup. These tools resolve the domain name into its corresponding IP address.

• Use the ping command.
• Use the nslookup command.
• Both display the IP address of a domain.

54. How to Find Your Port Number?

You can find active port numbers using command-line tools such as netstat or the Resource Monitor. These tools display open ports and the processes using them.

• Use the netstat command.
• Use Resource Monitor.
• Helps monitor network connections and troubleshoot issues.

55. Differentiate Between TCP and UDP

TCP and UDP are transport layer protocols. TCP provides reliable, connection-oriented communication, while UDP offers faster, connectionless communication without delivery guarantees.

56. What is the TCP Sliding Window? How Does It Improve Throughput?

The TCP Sliding Window is a flow control mechanism that allows multiple packets to be sent before receiving acknowledgments. As acknowledgments arrive, the window moves forward, allowing continuous data transmission. This improves throughput and bandwidth utilization.

• Allows multiple packets to be sent without waiting.
• The window slides forward as ACKs are received.
• Improves throughput and reduces idle time.

57. Differentiate Between Flow Control and Congestion Control

Flow Control prevents the sender from overwhelming the receiver, while Congestion Control prevents the network from becoming overloaded. Flow Control uses the Receive Window (rwnd), whereas Congestion Control uses the Congestion Window (cwnd). ( Flow Control vs Congestion Control )