Computer Networks Interview Questions and Answers: 60 Questions from Easy to Hard
This guide is for engineering students and freshers in India preparing for the networks round of campus placements, and for developers with a few years of experience who face networking questions in technical interviews. It has 60 questions with answers in three levels: the layers, devices, addresses and protocols every fresher must know; the standard interview questions on subnetting, routing, TCP, DNS and HTTPS; and the harder ones on congestion control, sliding windows, delays and tricky subnetting that top scorers get right. Every subnet and number in the answers was worked out and checked. Answer each question aloud before reading ours, redo the subnetting on paper, then take the mock test to practise under a timer.
- 60 questions, 3 levels
- Updated
- CoreHRx Jobs
- 17,463 open IT jobs
What computer networks interviews cover
- Models and devices: the OSI and TCP/IP layers, what a hub, switch and router do, and how MAC addresses and ARP connect layer 2 to layer 3.
- Addressing: IPv4 classes and private ranges, subnet masks, subnetting and CIDR, NAT, and the basics of IPv6.
- Transport: TCP vs UDP, the three-way handshake and connection close, ports and sockets, flow control and congestion control.
- Application protocols: DNS, DHCP, HTTP and HTTPS with TLS, and the classic question of what happens when you type a URL.
- For experienced roles: routing protocols (RIP, OSPF, BGP), firewalls and VPNs, delay and throughput calculations, and debugging real connection problems.
How to prepare (freshers and experienced)
- Freshers: learn the layers with one protocol and one device for each, then practise until you can explain the handshake, ARP, DNS and DHCP step by step without notes.
- Solve 20 to 30 subnetting problems on paper: the network and broadcast address of a host, splitting a block, summarising routes and VLSM. Speed comes only from practice.
- Learn the common port numbers (22, 25, 53, 67/68, 80, 443) and the formulas for transmission delay, propagation delay and stop-and-wait efficiency.
- Experienced developers: tie each topic to something you have seen in production, such as a TIME_WAIT pile-up, a DNS TTL during a migration or a TLS certificate error.
- Use the tools on your own laptop: ping, traceroute, dig, ss and curl -v, so your answers describe what you have actually seen.
Common mistakes and interview-day tips
- Do not mix up the layers: a switch forwards on MAC addresses, a router on IP addresses, and port numbers belong to the transport layer.
- In subnetting, remember that the network and broadcast addresses are not usable hosts, except on a /31 point-to-point link.
- Do not dismiss UDP as unreliable and therefore bad; explain the trade-off and where it wins, such as DNS, video calls and QUIC.
- Do not confuse flow control, which protects the receiver, with congestion control, which protects the network.
- Draw it: a quick sketch of the handshake, the layers or a subnet split makes your answer easier to follow and shows clear thinking.
Computer Networks interview questions: Easy questions (freshers)
20 questions1. What is the OSI model, and what does each of its seven layers do?
The OSI model splits network communication into seven layers so each can be designed and debugged on its own. From the bottom: Physical sends bits over a cable or radio; Data Link moves frames between devices on one link using MAC addresses; Network routes packets between networks using IP; Transport gives end-to-end delivery with ports (TCP, UDP); Session manages dialogues; Presentation handles data formats and encryption; Application is what programs use, such as HTTP or DNS. A common slip is putting a plain switch at layer 3; it works at layer 2.
2. How does the TCP/IP model compare with the OSI model, and what is encapsulation?
TCP/IP is the model the internet actually uses. It has four layers: Link, Internet (IP), Transport (TCP, UDP) and Application, which covers the top three OSI layers. Some textbooks show five layers by splitting Link into Data Link and Physical. Encapsulation means each layer wraps the data from the layer above with its own header: application data becomes a TCP segment (or UDP datagram), then an IP packet, then an Ethernet frame, and finally bits on the wire. The receiver strips the headers in reverse order, layer by layer.
3. What is the difference between a hub, a switch and a router?
A hub is a layer 1 device: it copies every incoming signal to all other ports, so all devices share the bandwidth and collisions are possible. A switch works at layer 2: it learns which MAC address sits on which port and sends a frame only to the right port, flooding only broadcasts and unknown addresses. A router works at layer 3: it connects different networks and forwards packets by destination IP using a routing table. In a small office in Pune, the switch links the PCs and the router links the office to the ISP.
4. What are a collision domain and a broadcast domain, and how do devices change them?
A collision domain is the set of devices whose transmissions can collide; a broadcast domain is the set of devices that receive each other's broadcasts, such as ARP requests. A hub keeps everything in one collision domain. A switch gives each port its own collision domain but keeps one broadcast domain (per VLAN). A router splits broadcast domains, because it does not forward broadcasts. So a 24-port switch has 24 collision domains and 1 broadcast domain. A very large broadcast domain wastes bandwidth, which is one reason to use VLANs.
5. What is the difference between a MAC address and an IP address?
A MAC address is a 48-bit hardware address written like 3c:52:82:1a:9f:04; the first 24 bits usually identify the maker (the OUI). It is used only on the local link, and switches forward frames by it. An IP address is a logical address set by the admin or by DHCP, and it is hierarchical, so routers can forward by network prefix across the internet. On every hop the frame gets new source and destination MACs, while the IP addresses stay the same end to end unless NAT changes them. MACs can be changed in software, so they are not a strong identity.
6. How does ARP find the MAC address for an IP address?
ARP (Address Resolution Protocol) maps an IPv4 address to a MAC address on the local network. When a host wants to send to 192.168.1.20 and has no entry in its ARP cache, it broadcasts an ARP request: who has 192.168.1.20? Every host on the LAN receives it, and only the owner sends a unicast reply with its MAC. The sender stores the answer in its ARP cache for a while and then sends the frame. ARP has no authentication, so any host can send a false reply (ARP spoofing). The commands below show the cache.
ip neigh show # Linux: the ARP (neighbour) cache
arp -a # Windows and older Linux tools7. What are the IPv4 address classes, and which ranges are private?
Classful addressing split IPv4 by the first octet: class A 1-126 (default /8), class B 128-191 (/16), class C 192-223 (/24), class D 224-239 for multicast and class E 240-255 reserved; 127 is kept for loopback. Classes were replaced by CIDR in 1993, but interviewers still ask. The private ranges from RFC 1918 are 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. They are not routed on the internet, so hosts using them go out through NAT. A common mistake is calling 172.32.0.1 private; it is not.
8. What are unicast, broadcast and multicast, and what are 127.0.0.1 and 255.255.255.255?
Unicast is one sender to one receiver, the normal case. Broadcast goes to every host on the local network: 255.255.255.255 is the limited broadcast, and the last address of a subnet, such as 192.168.1.255 in 192.168.1.0/24, is its directed broadcast. Multicast goes to the hosts that joined a group, using 224.0.0.0/4; OSPF, for example, uses 224.0.0.5. 127.0.0.1 is the loopback address: traffic never leaves the machine, which is handy for testing a server locally. Routers never forward the limited broadcast.
9. What is a subnet mask, and how many hosts does a /24 network have?
A subnet mask marks which bits of an IP address are the network part and which are the host part. /24 means the first 24 bits are network bits, the same as 255.255.255.0. That leaves 8 host bits, so 2^8 = 256 addresses, of which 254 can be given to hosts: the first is the network address and the last is the broadcast address. The general formula is 2^(32 - prefix) - 2 usable hosts, so a /26 has 62 and a /30 has 2. The usual mistake is forgetting to subtract the two reserved addresses.
10. What is a default gateway, and what happens if it is set wrongly?
The default gateway is the router a host sends packets to when the destination is not on its own subnet. The host uses its IP and mask to decide: if the destination is local, it delivers directly after ARP; otherwise it sends the frame to the gateway's MAC address. If the gateway is wrong or missing, the host can still reach machines on its own LAN but nothing outside, so the office printer works while websites fail. On Linux the gateway is the default route in the routing table, shown by the first command below.
ip route show default # Linux
route print # Windows11. What is the difference between TCP and UDP?
TCP is connection-oriented and reliable: it sets up a connection with a handshake, numbers every byte, retransmits lost data, delivers it in order and controls the sending rate. UDP is connectionless: it sends independent datagrams with no delivery, ordering or rate guarantees. TCP has a 20-byte minimum header, UDP only 8 bytes. Use TCP for web pages, email, file transfer and database connections; UDP suits DNS queries, voice and video calls, online games and QUIC, where low delay matters more than resending old data. UDP is simpler, not worse.
12. Explain the TCP three-way handshake. Why three steps and not two?
The client sends SYN with its initial sequence number x. The server replies SYN-ACK with its own sequence number y and acknowledgement x+1. The client sends ACK with acknowledgement y+1, and the connection is open. Three steps are needed because both sides choose a starting sequence number and each must see it confirmed by the other. With only two steps the server could not be sure its number reached the client, and a delayed old SYN could open a connection nobody asked for. Initial sequence numbers are chosen unpredictably for security.
13. What is a port number, and which well-known ports should you know?
An IP address finds the machine; a 16-bit port number (0 to 65535) finds the application on it. A TCP connection is identified by source IP, source port, destination IP and destination port. Ports 0-1023 are well-known (system) ports, 1024-49151 registered and 49152-65535 dynamic. Learn these: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS and 3306 MySQL. For client sockets Linux picks local ports from 32768-60999 by default, not from the IANA dynamic range.
14. What is DNS, and how is a name like www.example.com resolved?
DNS translates names into IP addresses. The browser first checks its own cache, then the OS cache. If there is no answer, the OS asks a recursive resolver, from the ISP or a public service. The resolver asks a root server, which points to the .com TLD servers; they point to the authoritative servers for example.com, which return the A record. The client's query to the resolver is recursive, while the resolver's queries down the chain are iterative. Every answer carries a TTL, and each cache keeps it that long, so repeat lookups are fast.
15. How does DHCP give an IP address to a new device?
DHCP uses four messages, remembered as DORA. Discover: the client, which has no address yet, broadcasts from 0.0.0.0 port 68 to 255.255.255.255 port 67. Offer: a DHCP server offers an address with the mask, gateway, DNS servers and lease time. Request: the client asks for the offered address, again by broadcast, so other servers know their offers were declined. Acknowledge: the server confirms. The address is leased, not owned; the client tries to renew at half the lease time (T1). Without DHCP every laptop on a college Wi-Fi would need manual setup.
16. What is the difference between HTTP and HTTPS?
HTTPS is HTTP sent inside a TLS connection, usually on port 443 instead of 80. TLS gives three things: encryption, so others on the same Wi-Fi or the ISP cannot read passwords or card numbers; integrity, so data cannot be changed in transit; and authentication, because the server proves its identity with a certificate signed by a trusted certificate authority. HTTPS does not mean a site is honest, only that you are talking to the domain in the address bar, and the domain name stays visible to the network through DNS and SNI.
17. What is NAT, and why do almost all home and office networks use it?
NAT (Network Address Translation) rewrites private source addresses to a public address at the router. A home router in Kochi may serve ten devices on 192.168.1.x with one public IPv4 address from the ISP. The common form, PAT (port address translation, or NAT overload), also changes the source port and keeps a table so replies return to the right device. NAT saves scarce IPv4 addresses. A side effect is that outside hosts cannot start connections to inside devices unless you set up port forwarding. NAT hides inside addresses, but it is not a firewall.
18. What is a firewall, and how do its rules work?
A firewall allows or blocks traffic using rules on source and destination IP, port, protocol and, in a stateful firewall, connection state. Rules are checked in order, the first match wins, and a default policy applies at the end, which should be deny for incoming traffic. A network firewall guards a whole network at its edge; a host firewall such as ufw protects one machine. The rules below let a web server accept HTTPS from anywhere and SSH only from the office IP. A frequent mistake is opening a database port to the whole internet.
sudo ufw default deny incoming
sudo ufw allow 443/tcp
sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
sudo ufw enable19. Why was IPv6 introduced, and what does an IPv6 address look like?
IPv4 has only about 4.3 billion addresses, which ran out as phones and devices multiplied. IPv6 uses 128-bit addresses, about 3.4 x 10^38 of them. An address is eight groups of four hex digits, such as 2001:0db8:0000:0000:0000:ff00:0042:8329. You may drop leading zeros in each group and replace one run of all-zero groups with ::, giving 2001:db8::ff00:42:8329. The :: can appear only once, or the address would be ambiguous. ::1 is the loopback address. IPv6 has no broadcast, and its huge space removes the need for NAT.
20. What do ping and traceroute do, and how do they work?
ping sends ICMP Echo Request messages and waits for Echo Replies, showing whether a host answers, the round-trip time and packet loss. traceroute shows the routers on the path: it sends probes with TTL 1, 2, 3 and so on, and each router that drops a probe because its TTL reached zero returns an ICMP Time Exceeded message, revealing its address. Linux traceroute sends UDP probes by default, while Windows tracert uses ICMP. A failed ping does not prove a host is down, because many firewalls block ICMP; test the real port too.
ping -c 4 example.com
traceroute example.com # Windows: tracert example.comReady to check yourself? Take the free Computer Networks mock test
Computer Networks interview questions: Medium questions (1-3 years)
20 questions21. Split 192.168.10.0/24 into four equal subnets. What is the range of each?
Four subnets need 2 extra network bits (2^2 = 4), so the prefix goes from /24 to /26, mask 255.255.255.192. Each /26 has 64 addresses and 62 usable hosts, so the block size is 64. The subnets are 192.168.10.0/26 (hosts .1 to .62, broadcast .63), 192.168.10.64/26 (.65 to .126, broadcast .127), 192.168.10.128/26 (.129 to .190, broadcast .191) and 192.168.10.192/26 (.193 to .254, broadcast .255). Python's ipaddress module, as below, is a quick way to check your paper working.
import ipaddress
net = ipaddress.ip_network('192.168.10.0/24')
for s in net.subnets(new_prefix=26):
print(s, s[1], s[-2], s.broadcast_address)22. For the host 172.16.45.130/20, find the network address, broadcast address and usable host range.
A /20 mask is 255.255.240.0, so the octet that matters is the third, with a block size of 256 - 240 = 16. The multiples of 16 around 45 are 32 and 48, so the network is 172.16.32.0 and the next network starts at 172.16.48.0. The broadcast address is one less, 172.16.47.255. Usable hosts run from 172.16.32.1 to 172.16.47.254, which is 2^12 - 2 = 4094 hosts. The block-size method avoids writing everything in binary. A common mistake is working on the fourth octet and answering 172.16.45.128.
23. A laptop on the office network shows the address 169.254.37.12. What went wrong, and how do you troubleshoot it?
169.254.0.0/16 is the IPv4 link-local range. Windows (where it is called APIPA) and macOS give themselves an address from it when no DHCP server answered, so the laptop never got an Offer. Check the cable or Wi-Fi association, whether the switch port is in the right VLAN, whether the DHCP pool is exhausted and, if the server sits in another subnet, whether the router has a DHCP relay (ip helper-address on Cisco), because DHCP broadcasts do not cross routers. Then release and renew the lease as below and check again.
ipconfig /all
ipconfig /release
ipconfig /renew24. Several routing table entries match a destination. Which route does the router use?
It uses the longest prefix match: the most specific route, the one with the longest mask, wins, whatever the order of the entries. With the table below, 10.20.30.77 matches /0, /8, /16 and /24, so it goes out eth2 on the /24. 10.20.99.5 matches the /16 and goes to 10.20.255.1. 10.9.1.1 matches only the /8 and the default, so it uses 10.255.0.1. 198.51.100.20 matches only the default route. Administrative distance and metrics decide only between routes to the same prefix, never between a /16 and a /24.
Destination Next hop
0.0.0.0/0 203.0.113.1 (ISP)
10.0.0.0/8 10.255.0.1
10.20.0.0/16 10.20.255.1
10.20.30.0/24 eth2 (directly connected)25. What is the difference between distance vector and link state routing? Compare RIP and OSPF.
In distance vector routing each router sends its neighbours its table of distances and trusts their view of the network. RIP is the classic example: the metric is hop count, 16 means unreachable so a path can be at most 15 hops, and it sends updates every 30 seconds on UDP port 520. It is simple but converges slowly. In link state routing every router floods the state of its own links, all build the same map and each runs Dijkstra's algorithm. OSPF works this way, with a cost usually derived from bandwidth, areas for scale and fast convergence.
26. What is BGP, and how is it different from OSPF?
BGP (Border Gateway Protocol) connects autonomous systems, the separately run networks of ISPs, cloud providers and large enterprises, each with its own AS number. OSPF is an interior protocol that finds the cheapest path inside one organisation. BGP is a path vector protocol: each route carries the list of ASes it passed through, which prevents loops, and routers choose routes by policy, such as local preference and AS path length, rather than by link speed. BGP runs over TCP port 179. A wrong announcement can pull traffic for someone else's prefix to the wrong network.
27. A host 192.168.1.10/24 sends a packet to 198.51.100.20. Whose MAC address does it ARP for, and what do the headers contain?
It ARPs for its default gateway, not for 198.51.100.20. The host applies its mask: 198.51.100.20 is not in 192.168.1.0/24, so the packet must go through the router. It finds the MAC of the gateway, say 192.168.1.1, in its cache or by ARP, and builds a frame whose destination MAC is the router's, while the IP header keeps destination 198.51.100.20. Each router repeats this on its next link, so MAC addresses change every hop and IP addresses stay the same. A wrong subnet mask on the host makes it ARP for remote addresses directly, and traffic fails.
28. How does PAT (NAT overload) keep track of many inside devices sharing one public IP?
The router keeps a translation table. When 192.168.1.10:51000 opens a connection to 198.51.100.10:443, the router rewrites the source to its public address 203.0.113.25 and a free port such as 40001, and records the mapping. A second laptop that also uses source port 51000 gets a different public port, 40002. When a reply arrives for 203.0.113.25:40002, the router looks it up and rewrites the destination back to that inside host. Entries expire when idle, which is why long idle TCP connections behind NAT need keepalives to survive.
Inside Public Remote
192.168.1.10:51000 203.0.113.25:40001 198.51.100.10:443
192.168.1.11:51000 203.0.113.25:40002 198.51.100.10:44329. How does TCP flow control work, and how is it different from congestion control?
Flow control protects the receiver. Every ACK carries a receive window (rwnd): how many more bytes the receiver's buffer can take. The sender keeps its unacknowledged data within that window. If the application reads slowly, the window shrinks, and at zero the sender stops and sends small probes (the persist timer) until space opens. Congestion control protects the network: the sender also keeps a congestion window (cwnd) that grows and shrinks with loss or delay. At most min(rwnd, cwnd) bytes can be in flight. Mixing the two up is a classic slip.
30. How is a TCP connection closed, and why does the TIME_WAIT state exist?
Closing usually takes four segments, because each direction closes separately: the side that closes first sends FIN, the other side ACKs it, later sends its own FIN, and the first side ACKs that. The side that closed first then stays in TIME_WAIT for twice the maximum segment lifetime, 60 seconds on Linux. This lets it resend the final ACK if that was lost and lets delayed old segments die before the same port pair is reused. Many sockets stuck in CLOSE_WAIT mean the application never called close() after the peer closed.
ss -tan state time-wait | wc -l
ss -tan state close-wait31. Which DNS record types should you know, and how do you query them?
A maps a name to an IPv4 address and AAAA to an IPv6 address. CNAME makes a name an alias of another name; it cannot sit at the zone apex or beside other records of the same name. MX lists mail servers with priorities, NS names the authoritative servers, TXT holds text such as SPF and domain verification, PTR maps an IP back to a name for reverse lookups, and SOA holds zone details such as the serial number. dig shows what a resolver really returns, which is the first check during a domain or hosting migration.
dig example.com A +short
dig example.com MX
dig www.example.com CNAME +short
dig -x 192.0.2.10 # reverse lookup (PTR)
dig @192.0.2.53 example.com # ask one specific resolver32. DNS normally uses UDP. When does it use TCP?
Most lookups are one small question and one answer, so UDP on port 53 avoids a handshake and keeps them fast. DNS falls back to TCP port 53 when an answer is too big for UDP: the server sets the TC (truncated) flag and the client retries over TCP. The classic UDP limit is 512 bytes; EDNS(0) lets clients advertise a bigger buffer, and many resolvers now use about 1232 bytes to avoid IP fragmentation. Zone transfers between servers (AXFR) also use TCP. RFC 7766 makes TCP support required, so blocking TCP 53 breaks things.
33. What happens during a TLS 1.3 handshake?
A full TLS 1.3 handshake takes one round trip. The client sends ClientHello with its cipher suites, a random value, the server name (SNI) and a Diffie-Hellman key share. The server answers with ServerHello and its own key share, and both sides compute the same secret. From here everything is encrypted: the server sends its certificate, a signature proving it holds the private key, and Finished. The client checks the certificate chain and hostname, then sends Finished. Data then flows under a fast symmetric cipher such as AES-GCM. TLS 1.2 needed two round trips.
34. What happens when you type https://www.example.com into a browser and press Enter?
The browser parses the URL and checks its cache. It resolves www.example.com through DNS: browser cache, OS cache, then the recursive resolver. Before the first packet leaves, the laptop ARPs for its gateway's MAC if needed. It opens a TCP connection to port 443 with the three-way handshake, then runs the TLS handshake, sending the name in SNI and checking the certificate. It sends an HTTP GET, which may pass a CDN or load balancer before reaching the app server, and HTML comes back. The browser parses it, fetches CSS, scripts and images, and renders the page.
35. What changed from HTTP/1.1 to HTTP/2?
HTTP/1.1 is text based, and each connection carries one request at a time; keep-alive reuses connections, but responses come back in order, so browsers open several connections per host, usually up to six. HTTP/2 keeps the same methods, headers and status codes but sends binary frames and multiplexes many streams over one TCP connection, with HPACK header compression. That removes old tricks such as domain sharding and image sprites. Its weak point is TCP itself: one lost packet stalls every stream until it is retransmitted, which HTTP/3 addresses.
36. What sequence of socket calls does a TCP server make, and what is a common bug when reading data?
A server calls socket(), bind() to an address and port, listen() with a backlog, then accept() in a loop; each accept() returns a new socket for one client while the listening socket keeps waiting. The client calls socket() and connect(), which runs the three-way handshake. SO_REUSEADDR lets the server restart while old connections sit in TIME_WAIT. The classic bug is assuming one recv() returns one whole message: TCP is a byte stream, so a message can arrive split or joined to the next one. Frame messages with a length prefix or a delimiter.
import socket
srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(('0.0.0.0', 9000))
srv.listen(128)
while True:
conn, addr = srv.accept()
with conn:
data = conn.recv(4096) # may be part of a message
conn.sendall(b'echo: ' + data)37. An app cannot reach its database: one error says connection refused, another says connection timed out. What does each tell you?
Connection refused means the SYN reached the host but nothing was listening on that port, so the kernel answered with a TCP RST, or a firewall actively rejected it. Check that the database is running and listening on the right interface; a server bound to 127.0.0.1 refuses other hosts. Timed out means nothing came back at all: a firewall or security group silently dropped the SYN, the route is wrong or the host is down. So refused points at the server process, and a timeout at the network path. Test from the app host first, then check the listener.
nc -zv db.internal 5432 # from the app server
ss -tlnp | grep 5432 # on the database host38. What is the difference between a stateful and a stateless firewall?
A stateless firewall, such as a router access list, checks every packet on its own. To let a web server reply, you must also allow the return traffic to the client's random high port, so the rules become wide. A stateful firewall tracks connections: once an allowed connection is set up, its return packets pass automatically and stray packets are dropped. On AWS, security groups are stateful but network ACLs are stateless, a frequent cause of one-way traffic after an ACL change. The iptables rules below show the usual stateful pattern.
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -P INPUT DROP39. What is a VLAN, and what is the difference between an access port and a trunk port?
A VLAN splits one physical switch into separate layer 2 networks, so the HR and finance PCs in a Hyderabad office can share switches but sit in different broadcast domains. An access port belongs to one VLAN and carries untagged frames to an end device. A trunk port carries several VLANs between switches or to a router, marking each frame with an IEEE 802.1Q tag: 4 bytes that hold a 12-bit VLAN ID, so IDs 1 to 4094 are usable. Hosts in different VLANs can talk only through a router or a layer 3 switch (inter-VLAN routing).
40. How does CRC detect errors? Compute the CRC for the data 11010110 with the generator 1011.
CRC treats the bits as a polynomial and divides by a generator using modulo-2 arithmetic, which is XOR with no carries. The generator 1011 has degree 3, so append three zeros, 11010110000, and divide: the remainder is 111. The sender transmits 11010110111. The receiver divides the whole frame by 1011; remainder 000 means no error was detected, and any single flipped bit gives a non-zero remainder. A degree-r generator with a 1 at both ends catches every burst error of length r or less. Parity, by contrast, misses any even number of flipped bits.
def crc_remainder(data, gen):
bits = list(data + '0' * (len(gen) - 1))
for i in range(len(data)):
if bits[i] == '1':
for j, g in enumerate(gen):
bits[i + j] = str(int(bits[i + j]) ^ int(g))
return ''.join(bits[-(len(gen) - 1):])
print(crc_remainder('11010110', '1011')) # 111Ready to check yourself? Take the free Computer Networks mock test
Computer Networks interview questions: Hard questions (experienced)
20 questions41. You have 10.20.0.0/24 for a branch with 100 sales hosts, 50 support hosts, 25 HR hosts and two point-to-point router links. Design the subnets with VLSM.
Allocate the largest subnet first so each block starts on its own boundary. 100 hosts need 7 host bits: 10.20.0.0/25 (126 hosts, .1 to .126). 50 hosts need a /26: 10.20.0.128/26 (.129 to .190). 25 hosts need a /27: 10.20.0.192/27 (.193 to .222). Each link needs 2 hosts, so a /30: 10.20.0.224/30 and 10.20.0.228/30. That leaves 10.20.0.232 to 10.20.0.255, 24 addresses, for growth. Starting with the small subnets can fragment the space so a big block no longer fits. A /31 per link (RFC 3021) saves more.
42. Summarise 10.1.4.0/24 to 10.1.7.0/24 as one route. Can 10.1.5.0/24 to 10.1.8.0/24 be summarised the same way?
Write the third octet in binary: 4 to 7 are 00000100 to 00000111, so the first 6 bits match, giving 16 + 6 = 22 common bits and the summary 10.1.4.0/22, exactly those four networks. 5 to 8 do not line up: a /22 must start at a multiple of 4 in the third octet, and 5 to 8 cross the boundary at 8. The smallest single route covering them is 10.1.0.0/20, which also covers twelve /24s you do not own and could pull in traffic for them. The exact minimal set is 10.1.5.0/24, 10.1.6.0/23 and 10.1.8.0/24.
43. A 1500-byte packet crosses a 100 Mbps fibre link 1,800 km long. What are its transmission and propagation delays, and which one dominates?
Transmission delay is the time to push the bits onto the link: size / bandwidth = 1500 x 8 / 100,000,000 = 120 microseconds. Propagation delay is the time for a bit to travel: 1,800,000 m / 2 x 10^8 m/s, the usual speed in fibre, = 9 ms. Propagation dominates by 75 times, and a faster link would not reduce it. On a 1 Mbps link the same packet takes 12 ms to transmit. Each router also adds queuing and processing delay. A 25 MB file (25 x 10^6 bytes) needs 2 seconds of transmission time at 100 Mbps.
44. What is the bandwidth-delay product, and why does a 64 KB TCP window cripple a 1 Gbps link with a 40 ms RTT?
The bandwidth-delay product is how much data must be in flight to keep the pipe full: 10^9 bits/s x 0.040 s = 40 million bits, or 5,000,000 bytes. TCP can send only one window before it waits for an ACK, so throughput is at most window / RTT. The original 16-bit window field allows 65,535 bytes, which gives 65,535 x 8 / 0.040 = about 13.1 Mbps, 1.3% of the link. The window scale option (RFC 7323), agreed in the SYN and SYN-ACK, multiplies the window by up to 2^14, about 1 GiB. Both hosts also need large enough socket buffers.
45. A 10 Mbps link sends 1000-byte frames with a one-way propagation delay of 5 ms. What is the efficiency of stop-and-wait, and what window fills the link?
Transmission time Tt = 1000 x 8 / 10^7 = 0.8 ms. Stop-and-wait sends one frame and waits a round trip for the ACK, so, ignoring ACK size, efficiency = Tt / (Tt + 2Tp) = 0.8 / 10.8 = 7.41%, about 0.74 Mbps of useful throughput. With a = Tp / Tt = 6.25, a sliding window needs 1 + 2a = 13.5, so 14 frames in flight. That needs 4-bit sequence numbers for Go-Back-N (window up to 15) and 5 bits for Selective Repeat (up to 16). A window of 7 gives 51.85% efficiency.
46. Why must the Go-Back-N window be at most 2^m - 1, and the Selective Repeat window at most 2^(m-1), for m-bit sequence numbers?
The receiver must never take a retransmitted old frame for a new one. With m = 3 (numbers 0 to 7) and a Go-Back-N window of 8, the sender sends 0 to 7; if every ACK is lost it resends 0, and the receiver, now expecting the next 0, accepts a duplicate. A window of 7 avoids this. Selective Repeat accepts out-of-order frames, so its window must not overlap the next one: with window 5, after 0 to 4 arrive and the ACKs are lost, the receiver accepts 5, 6, 7, 0, 1 and takes the resent old 0 as new. A window of 4 is safe.
47. TCP Reno starts at cwnd 1 MSS with ssthresh 16 MSS, and a timeout happens when cwnd reaches 20. Trace the window, and say how a triple duplicate ACK differs.
In the textbook model, per round trip, slow start doubles cwnd: 1, 2, 4, 8, 16; at ssthresh, congestion avoidance adds 1 MSS per RTT: 17, 18, 19, 20. On the timeout ssthresh becomes half of cwnd, 10, and cwnd drops to 1, so slow start runs again: 1, 2, 4, 8, then 10 (capped at ssthresh), then 11, 12. A triple duplicate ACK shows data is still getting through, so Reno does fast retransmit and fast recovery: ssthresh = 10 and cwnd continues from about 10, skipping slow start. Linux today starts at 10 MSS and uses CUBIC.
RTT 1 2 3 4 5 6 7 8 9 10 11 12 13 14
cwnd 1 2 4 8 16 17 18 19 20 1 2 4 8 1048. Why can a small request-response protocol over TCP see about 40 ms of extra latency, and what fixes it?
It is usually Nagle's algorithm meeting delayed ACKs. Nagle holds back a small segment while earlier data is unacknowledged, to avoid floods of tiny packets. The receiver delays its ACK, hoping to piggyback it on a reply, by about 40 ms on Linux and around 200 ms on Windows. If a client writes a request in two small pieces, header then body, the body waits for an ACK the server is deliberately holding back. Fixes: send the whole request in one write, and set TCP_NODELAY on latency-sensitive sockets, as most database and RPC clients do.
import socket
s = socket.create_connection(('10.0.4.20', 9000))
s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
header = b'LEN 5\n'
body = b'hello'
s.sendall(header + body) # one write, not two49. A Bengaluru fintech's service opens a new TCP connection for every call to a payment API and, under load, fails with 'Cannot assign requested address'. Why?
It has run out of ephemeral ports. Every outgoing connection to the same destination IP and port needs its own local port, and Linux picks them from 32768-60999 by default, which is 28,232 ports. The side that closes first keeps each socket in TIME_WAIT for 60 seconds, so the client can sustain only about 28,232 / 60 = 470 new connections per second to that destination. Fixes: reuse connections with keep-alive and a connection pool, widen ip_local_port_range, or enable tcp_tw_reuse for outgoing connections. Shrinking TIME_WAIT by hacks is risky.
50. What is a SYN flood, and how do SYN cookies defend against it?
In a SYN flood an attacker sends a huge number of SYNs, often from spoofed addresses, and never finishes the handshake. Each SYN usually makes a half-open entry in the SYN queue, so the queue fills and real clients cannot connect. With SYN cookies the server stores nothing for the SYN: it encodes the connection details (addresses, ports, MSS and a time counter) in a keyed hash used as its initial sequence number. Only a real client's ACK returns that number, and the server rebuilds the connection from it. Cookies carry little TCP option data, so Linux uses them only when the queue overflows.
sysctl net.ipv4.tcp_syncookies # 1 = cookies when the SYN queue overflows
sysctl net.ipv4.tcp_max_syn_backlog51. A 4000-byte IPv4 datagram with a 20-byte header must cross a link with a 1500-byte MTU. How is it fragmented?
Each fragment can carry at most 1500 - 20 = 1480 data bytes, and that is a multiple of 8, as it must be because offsets count 8-byte units. The 3980 data bytes split into 1480, 1480 and 1020. The fragments have total lengths 1500, 1500 and 1040, offsets 0, 185 and 370 (1480 / 8 = 185), and the More Fragments flag on the first two only. All keep the original identification value, and only the destination reassembles them. Losing one fragment loses the whole datagram, which is why TCP uses Path MTU discovery with the DF bit set.
52. OSPF runs Dijkstra's algorithm on the link costs below. What is R1's shortest path and cost to each router?
Dijkstra settles the cheapest unsettled router each round. From R1: R3 at cost 1; then R2 at 3 via R3, cheaper than the direct link at 4; then R4 at 8 via R1-R3-R2-R4, since R1-R2-R4 and R1-R3-R4 both cost 9; then R5 at 11 via R1-R3-R2-R4-R5, cheaper than R1-R3-R5 at 13. Fewer hops is not always cheaper. OSPF cost is normally reference bandwidth / link bandwidth; on Cisco IOS the reference defaults to 100 Mbps, so 100 Mbps and 1 Gbps links both cost 1 unless you raise the reference on every router.
Link Cost
R1-R2 4
R1-R3 1
R2-R3 2
R2-R4 5
R3-R4 8
R4-R5 3
R3-R5 1253. What is the count-to-infinity problem in distance vector routing, and how is it reduced?
Take a chain A - B - C. If the B-C link fails, B may hear A's old advert, C at 2 hops, which really goes through B, and set C to 3 hops via A. A then updates to 4 via B, and the two keep raising the metric until it reaches infinity, 16 in RIP, while packets loop between them. Fixes: split horizon (never advertise a route back to the neighbour you learned it from), poison reverse (advertise it back as unreachable), triggered updates and hold-down timers. Loops through three or more routers can still form, one reason large networks use link state.
54. How can DNS be used for load balancing and failover, and what are its limits?
A name can return several A records that clients spread across (round robin), or a GeoDNS service can answer with the nearest data centre, such as a Mumbai address for users in India. For failover, health checks remove a dead site's record. The limit is caching: resolvers and clients keep answers for the TTL, some longer, so failover is only as fast as the TTL allows. A low TTL such as 60 seconds speeds failover but raises query load. Anycast avoids the wait: the same IP is announced from many sites through BGP, and routing picks the nearest.
55. How does a client validate a server certificate, and what is forward secrecy?
The server sends its leaf certificate and the intermediates. The client builds a chain from the leaf up to a root in its trust store, checking each signature, the validity dates, revocation where supported, and that the hostname matches a Subject Alternative Name. A common production bug is a server that does not send its intermediate: some browsers fill the gap, while curl, Java or Android apps fail. Forward secrecy means a stolen private key cannot decrypt recorded past sessions, because each session uses ephemeral Diffie-Hellman keys. TLS 1.3 dropped static RSA key exchange for this reason.
56. Why does HTTP/3 run over QUIC on UDP instead of TCP?
HTTP/2 multiplexes streams over one TCP connection, but TCP delivers a single ordered byte stream, so one lost packet blocks every stream until it is resent (transport head-of-line blocking). QUIC, built on UDP, keeps streams inside the transport, so loss on one stream does not stall the others. It merges the transport and TLS 1.3 handshakes into one round trip, allows 0-RTT resumption, and uses connection IDs so a phone moving from Wi-Fi to mobile data keeps its connection. UDP was used because middleboxes block new IP protocols. Browsers fall back to HTTP/2 when UDP 443 is blocked.
57. Why is peer-to-peer connectivity hard behind NAT, and where do STUN, TURN and carrier-grade NAT fit in?
Two devices behind NAT have no public address the other can dial, and each NAT drops unsolicited inbound packets. STUN lets a peer learn its public IP and port mapping from a server; with UDP hole punching both peers send to each other's mapping at once, so each NAT sees outbound traffic first. This fails with symmetric NAT, which picks a new public port per destination; then traffic is relayed through a TURN server, at bandwidth cost. Many mobile networks add carrier-grade NAT in 100.64.0.0/10, putting users behind two NATs. ICE tries all these options in order.
58. How does IPv6 differ from IPv4 beyond the address size?
The base header is a fixed 40 bytes with optional extension headers and no header checksum, which simplifies router work. Routers never fragment IPv6 packets: the sender must use Path MTU discovery, and every link must carry at least 1280 bytes, so blocking ICMPv6 Packet Too Big breaks connections. ARP is replaced by Neighbor Discovery over ICMPv6, broadcast by multicast, and hosts can configure themselves with SLAAC from a /64 prefix in router advertisements. Every interface has a link-local fe80:: address. Most networks run dual stack, IPv4 and IPv6 side by side.
59. Compare IPsec and TLS-based VPNs. What are tunnel and transport mode, and what is split tunnelling?
IPsec works at the network layer: IKE negotiates the keys and ESP encrypts and authenticates each packet. Tunnel mode encrypts the whole original IP packet inside a new IP header, the usual choice for site-to-site VPNs between offices; transport mode protects only the payload between two hosts. TLS-based VPNs such as OpenVPN, and WireGuard with its own protocol over UDP, are common for remote access. Split tunnelling sends only company traffic through the VPN, saving bandwidth but leaving other traffic outside company controls. Every VPN adds headers, so lower the MTU.
60. Calls between two services in different data centres are slow only sometimes. How do you find out whether the network is the cause?
Measure before guessing. First split the time into DNS lookup, TCP connect, TLS handshake and server time; curl -w prints each. Run mtr for a few minutes to spot loss or latency at a hop; loss shown only at a middle hop is often just ICMP rate limiting there. On the client, ss -ti shows retransmits and a small cwnd, and a tcpdump capture shows retransmissions, zero windows or resets. Common causes are loss on one path, an MTU black hole after a VPN change, slow DNS, or a full accept queue on the server rather than the network.
curl -s -o /dev/null https://api.internal/health -w \
'dns %{time_namelookup} tcp %{time_connect} tls %{time_appconnect} all %{time_total}\n'
mtr -rwc 100 api.internal
ss -ti dst 10.0.4.20
tcpdump -i eth0 -nn host 10.0.4.20 and tcp port 443 -w slow.pcapPractice questions for November 2026
New every month3 questions from the Computer Networks mock test, the way they appear in it. A new set comes on the 1st of every month. Pick your answer, then open it.
-
Why has SSH replaced Telnet for logging in to servers?
- Telnet needs a graphical desktop on the server to work
- Telnet uses UDP, so the typed keys often arrive out of order
- Telnet sends everything, including passwords, as plain text
- Telnet works only on local networks and cannot cross a router
Show the answer
Answer: Telnet sends everything, including passwords, as plain text. Anyone who can capture the traffic on the path can read a Telnet password and session. SSH encrypts the session, checks the server host key, and supports key-based login. Telnet does run over TCP and can cross routers.
-
A Pune IT firm puts Nginx in front of its three app servers so that clients only ever connect to Nginx. What is Nginx acting as?
- A forward proxy for the clients
- A reverse proxy for the servers
- A layer 2 bridge between two LANs
- A DHCP relay for the servers
Show the answer
Answer: A reverse proxy for the servers. A reverse proxy sits in front of servers and accepts client connections on their behalf, then forwards requests to a backend; clients do not know the backends. A forward proxy sits in front of clients and fetches pages for them.
-
A VXLAN overlay carries untagged inner Ethernet frames with full 1500-byte payloads (the inner FCS is not carried). With an outer IPv4 header and no options, what is the smallest underlay IP MTU that avoids fragmentation?
- 1536 bytes
- 1550 bytes
- 1542 bytes
- 1564 bytes
Show the answer
Answer: 1550 bytes. The outer IP packet holds the 14-byte inner Ethernet header and 1,500-byte payload, plus the 8-byte VXLAN header, 8-byte UDP header and 20-byte IPv4 header: 1,550 bytes. The often quoted 50 bytes of overhead also counts the outer Ethernet header.
Ready to apply?
There are 17,463 open IT jobs on CoreHRx right now. Create a free profile once and apply with it.