Core CS and SQL interview guide

Computer networks interview questions and answers (Part 1)

OSI and TCP/IP, IP addressing, TCP and UDP, DNS and HTTP. Every answer is short enough to say aloud, and every question links to the lesson that teaches it.

60 questionsLast updated November 9, 2026

Computer Networks

1.What is the OSI model?
It is a seven-layer reference model for network communication: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer has one job and serves the layer above it. It is mainly used to explain and troubleshoot networking; real networks run on TCP/IP.
Follow-up: Which layers matter most in your daily work as a backend developer? Layers 3, 4 and 7: IP addressing, TCP or UDP ports, and the HTTP application protocol. The lower layers matter when you debug Wi-Fi, cables or switches.
Common mistake: Saying the internet runs on the OSI model. It runs on TCP/IP; OSI is a reference model used to explain and compare.
Lesson: OSI and TCP/IP models
2.What is the difference between the OSI and TCP/IP models?
OSI has seven layers and is a conceptual model. TCP/IP has four layers and is the protocol suite the internet uses. TCP/IP merges OSI layers 5 to 7 into Application and layers 1 and 2 into Network Access.
Follow-up: Where would you place TLS? Above TCP and below the application protocol, so it is often called layer 5 or 6, or "between 4 and 7". Textbooks differ, so state your assumption in one sentence.
Common mistake: Listing both models but not the mapping. Say clearly that TCP/IP merges OSI layers 5 to 7 into Application and 1 and 2 into Network Access.
Lesson: OSI and TCP/IP models
3.What is encapsulation in networking?
As data goes down the stack, each layer adds its own header: ports at transport, IP addresses at network, MAC addresses and a trailer at data link. The units are called segment, packet and frame. The receiver removes the headers in reverse, which is decapsulation.
Follow-up: What does the data link layer add that the layers above do not? A trailer with a frame check sequence (CRC) for error detection, together with the MAC header. Higher layers add only headers.
Common mistake: Saying every layer adds a header and a trailer. Only the data link layer adds a trailer.
Lesson: OSI and TCP/IP models
4.What does the data link layer do?
It moves frames between two directly connected devices on the same network. It adds MAC addresses and an error check (FCS) to each frame and controls access to the shared medium, as Ethernet and Wi-Fi do.
Lesson: OSI and TCP/IP models
5.What does the network layer do?
It delivers packets from the source host to the destination host across many networks. It uses logical IP addresses and routing to pick the path, and routers work at this layer.
Follow-up: What is the difference between routing and forwarding? Routing builds the table that says which way each network lies. Forwarding is the per-packet lookup that sends one packet out of the chosen port.
Lesson: OSI and TCP/IP models
6.What does the transport layer do?
It gives end-to-end delivery between two programs, using port numbers to reach the right one. TCP adds reliability, ordering and flow control; UDP just sends datagrams.
Follow-up: What does a port number identify? A program or service on a host. The IP address and port together form a socket, and ports live in the transport header, not in IP.
Lesson: OSI and TCP/IP models
7.What do the session and presentation layers do?
Session sets up, manages and ends a conversation between applications, for example keeping a login session or checkpoints. Presentation handles the format of data: encoding such as UTF-8, compression and encryption.
Lesson: OSI and TCP/IP models
8.What does the application layer do?
It gives network services directly to applications through protocols such as HTTP, DNS, SMTP and FTP. It is not the app itself; it is the protocol the app uses to talk over the network.
Lesson: OSI and TCP/IP models
9.What is decapsulation?
It is the reverse of encapsulation at the receiver. Each layer reads its own header, uses it, removes it and passes the rest up, until the application gets the original data.
Lesson: OSI and TCP/IP models
10.At which layer does a switch work, and a router?
A basic switch works at layer 2 and forwards frames using MAC addresses inside one network. A router works at layer 3 and forwards packets between networks using IP addresses. Layer 3 switches also exist, but the plain answer is switch layer 2, router layer 3.
Follow-up: What is a layer 3 switch? A switch that can also route between VLANs using IP addresses, at hardware speed. It joins a switch's speed to a router's layer 3 lookup.
Common mistake: Saying a router works only at layer 3. It has layers 1 and 2 on every interface; layer 3 is the highest layer it reads.
Lesson: OSI and TCP/IP models
11.Where does HTTPS fit in these models?
HTTP is application layer. The TLS encryption under it is often placed at the presentation layer in OSI, though textbooks differ; in TCP/IP it sits inside the Application layer, above TCP. I would say "TLS runs above TCP and below HTTP".
Follow-up: Is TLS a transport-layer protocol? Not exactly. It runs on top of TCP and below HTTP, so it sits between layers 4 and 7. Give the position, not just a number.
Lesson: OSI and TCP/IP models
12.Which layer would you check first if a website does not open?
I would go bottom-up quickly: is the cable or Wi-Fi connected (layers 1-2), does ping to the gateway and an IP work (layer 3), and does DNS resolve the name (application). If ping by IP works but the name fails, the problem is DNS, not the network.
Follow-up: Which tools check each layer? Layer 1: cable and Wi-Fi light. Layer 2: ARP table. Layer 3: ping the gateway and 8.8.8.8. Layer 4: connect to the port with nc. Layer 7: curl and the status code.
Lesson: OSI and TCP/IP models
13.Why is ARP hard to place on one layer?
ARP finds the MAC address (layer 2) for an IP address (layer 3), so it connects the two. Many books call it a layer 2 protocol and some say layer 2.5. In an interview I explain its job rather than argue about the number.
Lesson: OSI and TCP/IP models
14.Which layer handles error detection?
Several do. The data link layer checks each frame with a CRC, while TCP and UDP carry a checksum for the segment; TCP also recovers from errors by retransmitting.
Lesson: OSI and TCP/IP models
15.Which layers does a router use, and which does a switch use?
A router works up to layer 3: it reads IP headers to route packets. A basic switch works up to layer 2: it reads MAC addresses in frames. A hub only repeats bits at layer 1.
Lesson: OSI and TCP/IP models
16.What is a port number and at which layer does it belong?
A port is a 16-bit number that identifies a program or service on a host, such as 443 for HTTPS. It belongs to the transport layer (TCP and UDP).
Lesson: OSI and TCP/IP models
17.Is TCP/IP five layers or four?
The original model is four layers: Application, Transport, Internet and Network Access. Many textbooks teach a five-layer hybrid that splits Network Access into Physical and Data Link. Both are accepted if you say which one you mean.
Lesson: OSI and TCP/IP models
18.Why did OSI not become the internet standard?
TCP/IP was already working and widely deployed when the OSI protocols arrived, and the OSI protocols were complex. OSI survived as a teaching and troubleshooting model.
Follow-up: Do people still use OSI numbers? Yes, as a shared vocabulary. "Layer 2 switch", "layer 4 load balancer" and "layer 7 firewall" all use OSI numbers for TCP/IP devices.
Lesson: OSI and TCP/IP models
19.Which layer does a firewall work at?
It depends on the firewall. A simple packet filter works at layers 3 and 4 using IP addresses and ports, while an application firewall such as a web application firewall inspects layer 7 content like HTTP requests.
Follow-up: Which layer does a web application firewall work at? Layer 7. It reads HTTP content such as URLs and request bodies, while a classic packet-filter firewall reads only layers 3 and 4.
Lesson: OSI and TCP/IP models
20.A user can ping 8.8.8.8 but cannot open google.com. Which layer is the problem most likely at?
Ping by IP works, so the physical, data link and network layers are fine. The likely problem is DNS at the application layer, because the name is not being turned into an IP address.
Follow-up: Which command confirms it? Run nslookup or dig for the name. If the lookup fails while ping by IP works, DNS is the problem, which sits in the application layer of TCP/IP.
Common mistake: Blaming the cable or the router. When a ping by IP works, layers 1 to 3 are fine and the fault is higher up.
Lesson: OSI and TCP/IP models
21.Explain how a web request goes down and up the stack.
The browser creates an HTTP request (application). TCP adds ports and makes a segment, IP adds source and destination addresses to make a packet, Ethernet or Wi-Fi adds MAC addresses to make a frame, and the bits are sent. The server peels the headers off in reverse and hands the HTTP request to the web server.
Follow-up: What changes at each router on the way? The MAC addresses change at every hop because a new frame is built each time. The IP addresses stay the same (NAT aside) and the TTL drops by one.
Common mistake: Saying the IP addresses change at each hop. MAC addresses change per hop; IP addresses stay end to end.
Lesson: OSI and TCP/IP models
22.What is an IP address?
It is a logical address that identifies a device on a network so packets can be routed to it. IPv4 addresses are 32 bits written as four numbers from 0 to 255, like 192.168.1.10.
Lesson: IP addresses and subnetting basics
23.What is an octet?
An octet is 8 bits. An IPv4 address has four octets, and each can hold a value from 0 to 255.
Lesson: IP addresses and subnetting basics
24.What are the IPv4 classes?
Class A has first octet 1-126 with a default /8, class B 128-191 with /16, class C 192-223 with /24. Class D (224-239) is multicast and class E (240-255) is reserved.
Lesson: IP addresses and subnetting basics
25.What is a subnet mask?
It marks which bits of an address are the network part: 1s for network bits and 0s for host bits. For example /24 is 255.255.255.0.
Follow-up: How do you convert /19 to a mask? 19 is 8 + 8 + 3, so the first two octets are 255 and the third has three leading ones: 224. The mask is 255.255.224.0.
Common mistake: Writing the mask as 255.255.255.19 by copying the prefix. The prefix counts bits; convert 8 bits per octet.
Lesson: IP addresses and subnetting basics
26.What is the network address of a subnet?
It is the first address, where all host bits are 0. It names the subnet itself and is not given to a device.
Lesson: IP addresses and subnetting basics
27.What is the broadcast address?
It is the last address of a subnet, with all host bits set to 1. A packet sent to it reaches every device in that subnet.
Lesson: IP addresses and subnetting basics
28.What is the formula for usable hosts?
Usable hosts = 2^(32 − prefix) − 2. We subtract the network and broadcast addresses.
Follow-up: Why are /31 and /32 different? A /31 has only two addresses and is used on point-to-point links with no network or broadcast address, so both are usable. A /32 is a single host.
Common mistake: Forgetting to subtract 2, or forgetting the exception for /31 and /32 when the interviewer asks about links.
Lesson: IP addresses and subnetting basics
29.How do you find the network address quickly?
Take the octet where the mask is neither 255 nor 0, compute the block size as 256 minus the mask value, and round the address down to a multiple of the block size in that octet. Later octets become 0.
Follow-up: How do you find the broadcast address? It is the start of the next block minus 1. For 192.168.10.64/26 the next block starts at 128, so the broadcast is 192.168.10.127.
Lesson: IP addresses and subnetting basics
30.What is subnetting and why do we do it?
Subnetting splits one network into smaller networks by moving the boundary between network and host bits. It reduces broadcast traffic, separates departments for security and uses addresses efficiently. For example a /24 can become four /26 subnets of 62 hosts each.
Follow-up: What are the benefits besides saving addresses? Smaller broadcast domains, better security by separating departments, and simpler routing and troubleshooting.
Lesson: IP addresses and subnetting basics
31.How many usable hosts are in a /26, and why?
A /26 leaves 6 host bits, so 2⁶ = 64 addresses. The all-zeros address is the network and the all-ones address is the broadcast, so 62 are usable.
Follow-up: How would you check that quickly? A /26 leaves 6 host bits: 2 to the power 6 is 64 addresses, minus the network and broadcast addresses gives 62.
Common mistake: Answering 64. That number includes the network and broadcast addresses, which cannot be given to hosts.
Lesson: IP addresses and subnetting basics
32.What is CIDR, and why did it replace classes?
CIDR writes the network size as a prefix length like /22, so a network can be any size, not just /8, /16 or /24. Classes wasted many addresses; for example a company needing 500 addresses had to take a whole class B of 65,534. CIDR also lets routers merge many routes into one.
Follow-up: What is route aggregation? Combining adjacent networks into one route with a shorter prefix, for example four /24 networks into one /22, so routing tables stay small.
Lesson: IP addresses and subnetting basics
33.What is 127.0.0.1?
It is the loopback address, which always means this same computer. Packets sent to it never leave the machine, so developers use it to test a server running locally, such as a Spring Boot app on localhost:8080.
Lesson: IP addresses and subnetting basics
34.Why do we need IPv6?
IPv4 has only about 4.3 billion addresses, which is not enough for every phone, laptop and device. IPv6 has 128-bit addresses, about 3.4 × 10³⁸, so every device can have a public address without NAT. It also has a simpler header and automatic address configuration.
Lesson: IP addresses and subnetting basics
35.What is the default gateway?
It is the router's address on the local subnet. A device sends every packet meant for another network to the default gateway.
Lesson: IP addresses and subnetting basics
36.How can a host tell if a destination is on its own subnet?
It ANDs its own IP with its mask and the destination IP with the same mask. If the results match, the destination is local and it sends directly; otherwise it sends to the default gateway.
Follow-up: What if the destination is on a different subnet? The host sends the packet to its default gateway instead, and the router forwards it towards the destination.
Lesson: IP addresses and subnetting basics
37.What are 0.0.0.0 and 255.255.255.255 used for?
0.0.0.0 means "this host, no address yet", for example a DHCP client before it gets an address. 255.255.255.255 is the limited broadcast to every device on the local network.
Lesson: IP addresses and subnetting basics
38.What is APIPA or 169.254.x.x?
It is the link-local range a device gives itself when it cannot reach a DHCP server. It works only on the local link, so seeing it usually means DHCP failed.
Lesson: IP addresses and subnetting basics
39.What is supernetting or route aggregation?
It combines several smaller networks into one larger prefix, for example four /24 networks 192.168.0.0 to 192.168.3.0 into 192.168.0.0/22. Routers then need one route instead of four.
Lesson: IP addresses and subnetting basics
40.How many subnets do you get by borrowing 3 bits from a /24, and how many hosts each?
Borrowing 3 bits gives 2³ = 8 subnets with prefix /27. Each has 2⁵ − 2 = 30 usable hosts.
Lesson: IP addresses and subnetting basics
41.Is 192.168.1.0/24 a valid host address?
No, 192.168.1.0 is the network address of that /24 and cannot be assigned to a device. Hosts go from .1 to .254.
Lesson: IP addresses and subnetting basics
42.Are 10.1.1.10/24 and 10.1.2.10/24 in the same subnet? What about with /16?
With /24 they are not: the networks are 10.1.1.0 and 10.1.2.0. With /16 both belong to 10.1.0.0, so they are in the same subnet.
Lesson: IP addresses and subnetting basics
43.A /30 is often used between two routers. Why?
A /30 has exactly 2 usable addresses, one for each end of a point-to-point link, so no addresses are wasted. Some networks use /31 for the same link, which has no network or broadcast address.
Follow-up: Why not use a /29? A /29 gives six usable hosts and wastes four. A /30 gives exactly two usable addresses, enough for the two router ends, with nothing left over.
Lesson: IP addresses and subnetting basics
44.You need 1,000 hosts in one subnet. Which prefix do you choose?
I need at least 1,002 addresses, and 2¹⁰ = 1,024, so 10 host bits: /22. That gives 1,022 usable hosts.
Follow-up: What if the department will grow to 1,500 hosts? A /22 holds 1,022 hosts, so move to a /21, which holds 2,046. Pick the smallest prefix that fits the planned size, not only today's size.
Lesson: IP addresses and subnetting basics
45.What is a MAC address?
It is a 48-bit hardware address of a network interface, written as six hex pairs such as 3c:22:fb:1a:9e:40. It is used at the data link layer to deliver frames on the local network.
Lesson: MAC addresses, ARP, DHCP and NAT
46.Can a MAC address change?
The burned-in MAC normally stays the same, but the operating system can override it in software. Modern phones and laptops also use a random private MAC per Wi-Fi network for privacy.
Follow-up: Why do phones use random MAC addresses? To stop shops and networks from tracking a phone by its fixed hardware address. The phone uses a different private MAC for each Wi-Fi network.
Common mistake: Saying a MAC address can never change. The maker sets it, but software can change or randomise what the network sees.
Lesson: MAC addresses, ARP, DHCP and NAT
47.What is the broadcast MAC address?
It is ff:ff:ff:ff:ff:ff. A frame sent to it is received by every device on the local network, which is how ARP requests and DHCP Discover messages are delivered.
Lesson: MAC addresses, ARP, DHCP and NAT
48.Is an ARP request broadcast or unicast? And the reply?
The request is a broadcast because the sender does not know the MAC yet. The reply is normally unicast, sent directly back to the asker.
Lesson: MAC addresses, ARP, DHCP and NAT
49.What is the ARP cache and how can you see it?
It is a table of recent IP-to-MAC answers kept by the operating system, so each lookup is not repeated. On Windows, macOS and Linux, arp -a shows it. Entries expire after a while.
Lesson: MAC addresses, ARP, DHCP and NAT
50.What is the difference between a MAC address and an IP address?
A MAC address is a 48-bit hardware address used at layer 2 to deliver frames to the next device on the same network. An IP address is a logical layer 3 address used to route packets end to end, and it changes when you join a different network. MAC is like the name on the door; IP is like the postal address.
Follow-up: Which one do routers use to choose the path? The IP address. A router picks the next hop from the destination IP; the MAC address is used only for the last step on each local network.
Common mistake: Stopping at "MAC is physical, IP is logical". Add where each is used: MAC for one hop, IP end to end.
Lesson: MAC addresses, ARP, DHCP and NAT
51.What is the difference between ARP and DNS?
DNS turns a name like example.com into an IP address and works across the internet. ARP turns an IP address into a MAC address and works only inside the local network.
Follow-up: Which is used first when you open a website? DNS first, to turn the name into an IP address. Then ARP finds the gateway's MAC for the first hop.
Lesson: MAC addresses, ARP, DHCP and NAT
52.Explain DHCP.
DHCP automatically gives a device its IP address, subnet mask, gateway and DNS server. It uses four messages, Discover, Offer, Request and Acknowledge, over UDP ports 67 and 68. The address is leased for a fixed time and renewed while the device stays connected.
Follow-up: What does DHCP give besides the IP address? The subnet mask, the default gateway, the DNS server addresses and a lease time.
Common mistake: Answering only "it gives an IP". Mention the gateway, DNS and the lease as well.
Lesson: MAC addresses, ARP, DHCP and NAT
53.What is NAT, and why is it used?
NAT lets devices with private IPs share one public IP. The router rewrites the source IP and port of outgoing packets and keeps a table so replies go back to the right device. It mainly exists because there are not enough IPv4 addresses.
Follow-up: Is NAT a security feature? Not by design. Blocking unrequested incoming traffic is a side effect, and a real firewall still applies rules and logs.
Common mistake: Calling NAT a firewall. It translates addresses; it does not decide what is allowed.
Lesson: MAC addresses, ARP, DHCP and NAT
54.Can an attacker fake ARP replies? What happens?
Yes, ARP has no authentication, so an attacker on the same LAN can send fake replies saying "the gateway IP is at my MAC". This is ARP spoofing, and it lets the attacker read traffic as a man in the middle. Defences include dynamic ARP inspection on switches and using encrypted protocols like HTTPS.
Follow-up: How do you defend against ARP spoofing? Use dynamic ARP inspection on managed switches, static entries for key hosts, and HTTPS or a VPN so a man in the middle sees nothing useful.
Lesson: MAC addresses, ARP, DHCP and NAT
55.Why can't my friend open the server running on my home laptop?
My laptop has a private IP behind the router's NAT. The router drops incoming connections that have no NAT table entry. I would need port forwarding on the router, or a hosting service or tunnel, to make it reachable.
Follow-up: How would you let your friend reach it? Set up port forwarding on the router to your laptop's private IP and port, or use a tunnel or a cloud deployment. Also check the laptop's own firewall.
Lesson: MAC addresses, ARP, DHCP and NAT
56.What happens if the DHCP server is down when you connect?
The device gets no offer. Many operating systems then assign themselves a 169.254.x.x link-local address, which works only on the local link, so there is no internet. A device that already had a lease can keep using it until the lease runs out.
Follow-up: What address does the device end up with? Many systems give themselves a 169.254.x.x address (APIPA). It works only on the local link, so the internet stays unreachable.
Lesson: MAC addresses, ARP, DHCP and NAT
57.What is RARP and why is it not used now?
Reverse ARP let a device find its IP from its MAC. It was replaced by BOOTP and then DHCP, which also give the mask, gateway and DNS server.
Lesson: MAC addresses, ARP, DHCP and NAT
58.What is a DHCP lease, and what happens when it ends?
A lease is the time for which the device may use the address. The client tries to renew at half the lease time; if it cannot renew before the lease ends, it must stop using the address and start DHCP again.
Follow-up: When does the client try to renew? At half the lease time it asks the same server to renew. If that fails, it broadcasts again near 87.5 percent of the lease.
Lesson: MAC addresses, ARP, DHCP and NAT
59.Why is the DHCP Discover a broadcast?
The new device has no IP address and does not know where the DHCP server is, so it sends from 0.0.0.0 to the broadcast address 255.255.255.255.
Follow-up: Why is the Request broadcast too? So any other DHCP server that sent an offer learns which offer was chosen and can release its own address.
Lesson: MAC addresses, ARP, DHCP and NAT
60.What is a DHCP reservation?
It is a rule on the DHCP server that always gives the same IP to a particular MAC address. It is used for printers and servers that should keep a fixed address while still being managed by DHCP.
Lesson: MAC addresses, ARP, DHCP and NAT

All interview question guides

Learn it, then practise it

Each lesson has quizzes, practice and more interview questions on the same topic.

Open the first lesson

Computer Networks course: syllabus and 1:1 mentoringLayered models, IP and subnetting, routing, TCP and UDP, DNS, HTTP and security.

Computer Networks

1.What is the OSI model?

It is a seven-layer reference model for network communication: Physical, Data Link, Network, Transport, Session, Presentation and Application. Each layer has one job and serves the layer above it. It is mainly used to explain and troubleshoot networking; real networks run on TCP/IP.

Follow-up: Which layers matter most in your daily work as a backend developer? Layers 3, 4 and 7: IP addressing, TCP or UDP ports, and the HTTP application protocol. The lower layers matter when you debug Wi-Fi, cables or switches.

Common mistake: Saying the internet runs on the OSI model. It runs on TCP/IP; OSI is a reference model used to explain and compare.

Lesson: OSI and TCP/IP models

2.What is the difference between the OSI and TCP/IP models?

OSI has seven layers and is a conceptual model. TCP/IP has four layers and is the protocol suite the internet uses. TCP/IP merges OSI layers 5 to 7 into Application and layers 1 and 2 into Network Access.

Follow-up: Where would you place TLS? Above TCP and below the application protocol, so it is often called layer 5 or 6, or "between 4 and 7". Textbooks differ, so state your assumption in one sentence.

Common mistake: Listing both models but not the mapping. Say clearly that TCP/IP merges OSI layers 5 to 7 into Application and 1 and 2 into Network Access.

Lesson: OSI and TCP/IP models

3.What is encapsulation in networking?

As data goes down the stack, each layer adds its own header: ports at transport, IP addresses at network, MAC addresses and a trailer at data link. The units are called segment, packet and frame. The receiver removes the headers in reverse, which is decapsulation.

Follow-up: What does the data link layer add that the layers above do not? A trailer with a frame check sequence (CRC) for error detection, together with the MAC header. Higher layers add only headers.

Common mistake: Saying every layer adds a header and a trailer. Only the data link layer adds a trailer.

Lesson: OSI and TCP/IP models

4.What does the data link layer do?

It moves frames between two directly connected devices on the same network. It adds MAC addresses and an error check (FCS) to each frame and controls access to the shared medium, as Ethernet and Wi-Fi do.

Lesson: OSI and TCP/IP models

5.What does the network layer do?

It delivers packets from the source host to the destination host across many networks. It uses logical IP addresses and routing to pick the path, and routers work at this layer.

Follow-up: What is the difference between routing and forwarding? Routing builds the table that says which way each network lies. Forwarding is the per-packet lookup that sends one packet out of the chosen port.

Lesson: OSI and TCP/IP models

6.What does the transport layer do?

It gives end-to-end delivery between two programs, using port numbers to reach the right one. TCP adds reliability, ordering and flow control; UDP just sends datagrams.

Follow-up: What does a port number identify? A program or service on a host. The IP address and port together form a socket, and ports live in the transport header, not in IP.

Lesson: OSI and TCP/IP models

7.What do the session and presentation layers do?

Session sets up, manages and ends a conversation between applications, for example keeping a login session or checkpoints. Presentation handles the format of data: encoding such as UTF-8, compression and encryption.

Lesson: OSI and TCP/IP models

8.What does the application layer do?

It gives network services directly to applications through protocols such as HTTP, DNS, SMTP and FTP. It is not the app itself; it is the protocol the app uses to talk over the network.

Lesson: OSI and TCP/IP models

9.What is decapsulation?

It is the reverse of encapsulation at the receiver. Each layer reads its own header, uses it, removes it and passes the rest up, until the application gets the original data.

Lesson: OSI and TCP/IP models

10.At which layer does a switch work, and a router?

A basic switch works at layer 2 and forwards frames using MAC addresses inside one network. A router works at layer 3 and forwards packets between networks using IP addresses. Layer 3 switches also exist, but the plain answer is switch layer 2, router layer 3.

Follow-up: What is a layer 3 switch? A switch that can also route between VLANs using IP addresses, at hardware speed. It joins a switch's speed to a router's layer 3 lookup.

Common mistake: Saying a router works only at layer 3. It has layers 1 and 2 on every interface; layer 3 is the highest layer it reads.

Lesson: OSI and TCP/IP models

11.Where does HTTPS fit in these models?

HTTP is application layer. The TLS encryption under it is often placed at the presentation layer in OSI, though textbooks differ; in TCP/IP it sits inside the Application layer, above TCP. I would say "TLS runs above TCP and below HTTP".

Follow-up: Is TLS a transport-layer protocol? Not exactly. It runs on top of TCP and below HTTP, so it sits between layers 4 and 7. Give the position, not just a number.

Lesson: OSI and TCP/IP models

12.Which layer would you check first if a website does not open?

I would go bottom-up quickly: is the cable or Wi-Fi connected (layers 1-2), does ping to the gateway and an IP work (layer 3), and does DNS resolve the name (application). If ping by IP works but the name fails, the problem is DNS, not the network.

Follow-up: Which tools check each layer? Layer 1: cable and Wi-Fi light. Layer 2: ARP table. Layer 3: ping the gateway and 8.8.8.8. Layer 4: connect to the port with nc. Layer 7: curl and the status code.

Lesson: OSI and TCP/IP models

13.Why is ARP hard to place on one layer?

ARP finds the MAC address (layer 2) for an IP address (layer 3), so it connects the two. Many books call it a layer 2 protocol and some say layer 2.5. In an interview I explain its job rather than argue about the number.

Lesson: OSI and TCP/IP models

14.Which layer handles error detection?

Several do. The data link layer checks each frame with a CRC, while TCP and UDP carry a checksum for the segment; TCP also recovers from errors by retransmitting.

Lesson: OSI and TCP/IP models

15.Which layers does a router use, and which does a switch use?

A router works up to layer 3: it reads IP headers to route packets. A basic switch works up to layer 2: it reads MAC addresses in frames. A hub only repeats bits at layer 1.

Lesson: OSI and TCP/IP models

16.What is a port number and at which layer does it belong?

A port is a 16-bit number that identifies a program or service on a host, such as 443 for HTTPS. It belongs to the transport layer (TCP and UDP).

Lesson: OSI and TCP/IP models

17.Is TCP/IP five layers or four?

The original model is four layers: Application, Transport, Internet and Network Access. Many textbooks teach a five-layer hybrid that splits Network Access into Physical and Data Link. Both are accepted if you say which one you mean.

Lesson: OSI and TCP/IP models

18.Why did OSI not become the internet standard?

TCP/IP was already working and widely deployed when the OSI protocols arrived, and the OSI protocols were complex. OSI survived as a teaching and troubleshooting model.

Follow-up: Do people still use OSI numbers? Yes, as a shared vocabulary. "Layer 2 switch", "layer 4 load balancer" and "layer 7 firewall" all use OSI numbers for TCP/IP devices.

Lesson: OSI and TCP/IP models

19.Which layer does a firewall work at?

It depends on the firewall. A simple packet filter works at layers 3 and 4 using IP addresses and ports, while an application firewall such as a web application firewall inspects layer 7 content like HTTP requests.

Follow-up: Which layer does a web application firewall work at? Layer 7. It reads HTTP content such as URLs and request bodies, while a classic packet-filter firewall reads only layers 3 and 4.

Lesson: OSI and TCP/IP models

20.A user can ping 8.8.8.8 but cannot open google.com. Which layer is the problem most likely at?

Ping by IP works, so the physical, data link and network layers are fine. The likely problem is DNS at the application layer, because the name is not being turned into an IP address.

Follow-up: Which command confirms it? Run nslookup or dig for the name. If the lookup fails while ping by IP works, DNS is the problem, which sits in the application layer of TCP/IP.

Common mistake: Blaming the cable or the router. When a ping by IP works, layers 1 to 3 are fine and the fault is higher up.

Lesson: OSI and TCP/IP models

21.Explain how a web request goes down and up the stack.

The browser creates an HTTP request (application). TCP adds ports and makes a segment, IP adds source and destination addresses to make a packet, Ethernet or Wi-Fi adds MAC addresses to make a frame, and the bits are sent. The server peels the headers off in reverse and hands the HTTP request to the web server.

Follow-up: What changes at each router on the way? The MAC addresses change at every hop because a new frame is built each time. The IP addresses stay the same (NAT aside) and the TTL drops by one.

Common mistake: Saying the IP addresses change at each hop. MAC addresses change per hop; IP addresses stay end to end.

Lesson: OSI and TCP/IP models

22.What is an IP address?

It is a logical address that identifies a device on a network so packets can be routed to it. IPv4 addresses are 32 bits written as four numbers from 0 to 255, like 192.168.1.10.

Lesson: IP addresses and subnetting basics

23.What is an octet?

An octet is 8 bits. An IPv4 address has four octets, and each can hold a value from 0 to 255.

Lesson: IP addresses and subnetting basics

24.What are the IPv4 classes?

Class A has first octet 1-126 with a default /8, class B 128-191 with /16, class C 192-223 with /24. Class D (224-239) is multicast and class E (240-255) is reserved.

Lesson: IP addresses and subnetting basics

25.What is a subnet mask?

It marks which bits of an address are the network part: 1s for network bits and 0s for host bits. For example /24 is 255.255.255.0.

Follow-up: How do you convert /19 to a mask? 19 is 8 + 8 + 3, so the first two octets are 255 and the third has three leading ones: 224. The mask is 255.255.224.0.

Common mistake: Writing the mask as 255.255.255.19 by copying the prefix. The prefix counts bits; convert 8 bits per octet.

Lesson: IP addresses and subnetting basics

26.What is the network address of a subnet?

It is the first address, where all host bits are 0. It names the subnet itself and is not given to a device.

Lesson: IP addresses and subnetting basics

27.What is the broadcast address?

It is the last address of a subnet, with all host bits set to 1. A packet sent to it reaches every device in that subnet.

Lesson: IP addresses and subnetting basics

28.What is the formula for usable hosts?

Usable hosts = 2^(32 − prefix) − 2. We subtract the network and broadcast addresses.

Follow-up: Why are /31 and /32 different? A /31 has only two addresses and is used on point-to-point links with no network or broadcast address, so both are usable. A /32 is a single host.

Common mistake: Forgetting to subtract 2, or forgetting the exception for /31 and /32 when the interviewer asks about links.

Lesson: IP addresses and subnetting basics

29.How do you find the network address quickly?

Take the octet where the mask is neither 255 nor 0, compute the block size as 256 minus the mask value, and round the address down to a multiple of the block size in that octet. Later octets become 0.

Follow-up: How do you find the broadcast address? It is the start of the next block minus 1. For 192.168.10.64/26 the next block starts at 128, so the broadcast is 192.168.10.127.

Lesson: IP addresses and subnetting basics

30.What is subnetting and why do we do it?

Subnetting splits one network into smaller networks by moving the boundary between network and host bits. It reduces broadcast traffic, separates departments for security and uses addresses efficiently. For example a /24 can become four /26 subnets of 62 hosts each.

Follow-up: What are the benefits besides saving addresses? Smaller broadcast domains, better security by separating departments, and simpler routing and troubleshooting.

Lesson: IP addresses and subnetting basics

31.How many usable hosts are in a /26, and why?

A /26 leaves 6 host bits, so 2⁶ = 64 addresses. The all-zeros address is the network and the all-ones address is the broadcast, so 62 are usable.

Follow-up: How would you check that quickly? A /26 leaves 6 host bits: 2 to the power 6 is 64 addresses, minus the network and broadcast addresses gives 62.

Common mistake: Answering 64. That number includes the network and broadcast addresses, which cannot be given to hosts.

Lesson: IP addresses and subnetting basics

32.What is CIDR, and why did it replace classes?

CIDR writes the network size as a prefix length like /22, so a network can be any size, not just /8, /16 or /24. Classes wasted many addresses; for example a company needing 500 addresses had to take a whole class B of 65,534. CIDR also lets routers merge many routes into one.

Follow-up: What is route aggregation? Combining adjacent networks into one route with a shorter prefix, for example four /24 networks into one /22, so routing tables stay small.

Lesson: IP addresses and subnetting basics

33.What is 127.0.0.1?

It is the loopback address, which always means this same computer. Packets sent to it never leave the machine, so developers use it to test a server running locally, such as a Spring Boot app on localhost:8080.

Lesson: IP addresses and subnetting basics

34.Why do we need IPv6?

IPv4 has only about 4.3 billion addresses, which is not enough for every phone, laptop and device. IPv6 has 128-bit addresses, about 3.4 × 10³⁸, so every device can have a public address without NAT. It also has a simpler header and automatic address configuration.

Lesson: IP addresses and subnetting basics

35.What is the default gateway?

It is the router's address on the local subnet. A device sends every packet meant for another network to the default gateway.

Lesson: IP addresses and subnetting basics

36.How can a host tell if a destination is on its own subnet?

It ANDs its own IP with its mask and the destination IP with the same mask. If the results match, the destination is local and it sends directly; otherwise it sends to the default gateway.

Follow-up: What if the destination is on a different subnet? The host sends the packet to its default gateway instead, and the router forwards it towards the destination.

Lesson: IP addresses and subnetting basics

37.What are 0.0.0.0 and 255.255.255.255 used for?

0.0.0.0 means "this host, no address yet", for example a DHCP client before it gets an address. 255.255.255.255 is the limited broadcast to every device on the local network.

Lesson: IP addresses and subnetting basics

38.What is APIPA or 169.254.x.x?

It is the link-local range a device gives itself when it cannot reach a DHCP server. It works only on the local link, so seeing it usually means DHCP failed.

Lesson: IP addresses and subnetting basics

39.What is supernetting or route aggregation?

It combines several smaller networks into one larger prefix, for example four /24 networks 192.168.0.0 to 192.168.3.0 into 192.168.0.0/22. Routers then need one route instead of four.

Lesson: IP addresses and subnetting basics

40.How many subnets do you get by borrowing 3 bits from a /24, and how many hosts each?

Borrowing 3 bits gives 2³ = 8 subnets with prefix /27. Each has 2⁵ − 2 = 30 usable hosts.

Lesson: IP addresses and subnetting basics

41.Is 192.168.1.0/24 a valid host address?

No, 192.168.1.0 is the network address of that /24 and cannot be assigned to a device. Hosts go from .1 to .254.

Lesson: IP addresses and subnetting basics

42.Are 10.1.1.10/24 and 10.1.2.10/24 in the same subnet? What about with /16?

With /24 they are not: the networks are 10.1.1.0 and 10.1.2.0. With /16 both belong to 10.1.0.0, so they are in the same subnet.

Lesson: IP addresses and subnetting basics

43.A /30 is often used between two routers. Why?

A /30 has exactly 2 usable addresses, one for each end of a point-to-point link, so no addresses are wasted. Some networks use /31 for the same link, which has no network or broadcast address.

Follow-up: Why not use a /29? A /29 gives six usable hosts and wastes four. A /30 gives exactly two usable addresses, enough for the two router ends, with nothing left over.

Lesson: IP addresses and subnetting basics

44.You need 1,000 hosts in one subnet. Which prefix do you choose?

I need at least 1,002 addresses, and 2¹⁰ = 1,024, so 10 host bits: /22. That gives 1,022 usable hosts.

Follow-up: What if the department will grow to 1,500 hosts? A /22 holds 1,022 hosts, so move to a /21, which holds 2,046. Pick the smallest prefix that fits the planned size, not only today's size.

Lesson: IP addresses and subnetting basics

45.What is a MAC address?

It is a 48-bit hardware address of a network interface, written as six hex pairs such as 3c:22:fb:1a:9e:40. It is used at the data link layer to deliver frames on the local network.

Lesson: MAC addresses, ARP, DHCP and NAT

46.Can a MAC address change?

The burned-in MAC normally stays the same, but the operating system can override it in software. Modern phones and laptops also use a random private MAC per Wi-Fi network for privacy.

Follow-up: Why do phones use random MAC addresses? To stop shops and networks from tracking a phone by its fixed hardware address. The phone uses a different private MAC for each Wi-Fi network.

Common mistake: Saying a MAC address can never change. The maker sets it, but software can change or randomise what the network sees.

Lesson: MAC addresses, ARP, DHCP and NAT

47.What is the broadcast MAC address?

It is ff:ff:ff:ff:ff:ff. A frame sent to it is received by every device on the local network, which is how ARP requests and DHCP Discover messages are delivered.

Lesson: MAC addresses, ARP, DHCP and NAT

48.Is an ARP request broadcast or unicast? And the reply?

The request is a broadcast because the sender does not know the MAC yet. The reply is normally unicast, sent directly back to the asker.

Lesson: MAC addresses, ARP, DHCP and NAT

49.What is the ARP cache and how can you see it?

It is a table of recent IP-to-MAC answers kept by the operating system, so each lookup is not repeated. On Windows, macOS and Linux, arp -a shows it. Entries expire after a while.

Lesson: MAC addresses, ARP, DHCP and NAT

50.What is the difference between a MAC address and an IP address?

A MAC address is a 48-bit hardware address used at layer 2 to deliver frames to the next device on the same network. An IP address is a logical layer 3 address used to route packets end to end, and it changes when you join a different network. MAC is like the name on the door; IP is like the postal address.

Follow-up: Which one do routers use to choose the path? The IP address. A router picks the next hop from the destination IP; the MAC address is used only for the last step on each local network.

Common mistake: Stopping at "MAC is physical, IP is logical". Add where each is used: MAC for one hop, IP end to end.

Lesson: MAC addresses, ARP, DHCP and NAT

51.What is the difference between ARP and DNS?

DNS turns a name like example.com into an IP address and works across the internet. ARP turns an IP address into a MAC address and works only inside the local network.

Follow-up: Which is used first when you open a website? DNS first, to turn the name into an IP address. Then ARP finds the gateway's MAC for the first hop.

Lesson: MAC addresses, ARP, DHCP and NAT

52.Explain DHCP.

DHCP automatically gives a device its IP address, subnet mask, gateway and DNS server. It uses four messages, Discover, Offer, Request and Acknowledge, over UDP ports 67 and 68. The address is leased for a fixed time and renewed while the device stays connected.

Follow-up: What does DHCP give besides the IP address? The subnet mask, the default gateway, the DNS server addresses and a lease time.

Common mistake: Answering only "it gives an IP". Mention the gateway, DNS and the lease as well.

Lesson: MAC addresses, ARP, DHCP and NAT

53.What is NAT, and why is it used?

NAT lets devices with private IPs share one public IP. The router rewrites the source IP and port of outgoing packets and keeps a table so replies go back to the right device. It mainly exists because there are not enough IPv4 addresses.

Follow-up: Is NAT a security feature? Not by design. Blocking unrequested incoming traffic is a side effect, and a real firewall still applies rules and logs.

Common mistake: Calling NAT a firewall. It translates addresses; it does not decide what is allowed.

Lesson: MAC addresses, ARP, DHCP and NAT

54.Can an attacker fake ARP replies? What happens?

Yes, ARP has no authentication, so an attacker on the same LAN can send fake replies saying "the gateway IP is at my MAC". This is ARP spoofing, and it lets the attacker read traffic as a man in the middle. Defences include dynamic ARP inspection on switches and using encrypted protocols like HTTPS.

Follow-up: How do you defend against ARP spoofing? Use dynamic ARP inspection on managed switches, static entries for key hosts, and HTTPS or a VPN so a man in the middle sees nothing useful.

Lesson: MAC addresses, ARP, DHCP and NAT

55.Why can't my friend open the server running on my home laptop?

My laptop has a private IP behind the router's NAT. The router drops incoming connections that have no NAT table entry. I would need port forwarding on the router, or a hosting service or tunnel, to make it reachable.

Follow-up: How would you let your friend reach it? Set up port forwarding on the router to your laptop's private IP and port, or use a tunnel or a cloud deployment. Also check the laptop's own firewall.

Lesson: MAC addresses, ARP, DHCP and NAT

56.What happens if the DHCP server is down when you connect?

The device gets no offer. Many operating systems then assign themselves a 169.254.x.x link-local address, which works only on the local link, so there is no internet. A device that already had a lease can keep using it until the lease runs out.

Follow-up: What address does the device end up with? Many systems give themselves a 169.254.x.x address (APIPA). It works only on the local link, so the internet stays unreachable.

Lesson: MAC addresses, ARP, DHCP and NAT

57.What is RARP and why is it not used now?

Reverse ARP let a device find its IP from its MAC. It was replaced by BOOTP and then DHCP, which also give the mask, gateway and DNS server.

Lesson: MAC addresses, ARP, DHCP and NAT

58.What is a DHCP lease, and what happens when it ends?

A lease is the time for which the device may use the address. The client tries to renew at half the lease time; if it cannot renew before the lease ends, it must stop using the address and start DHCP again.

Follow-up: When does the client try to renew? At half the lease time it asks the same server to renew. If that fails, it broadcasts again near 87.5 percent of the lease.

Lesson: MAC addresses, ARP, DHCP and NAT

59.Why is the DHCP Discover a broadcast?

The new device has no IP address and does not know where the DHCP server is, so it sends from 0.0.0.0 to the broadcast address 255.255.255.255.

Follow-up: Why is the Request broadcast too? So any other DHCP server that sent an offer learns which offer was chosen and can release its own address.

Lesson: MAC addresses, ARP, DHCP and NAT

60.What is a DHCP reservation?

It is a rule on the DHCP server that always gives the same IP to a particular MAC address. It is used for printers and servers that should keep a fixed address while still being managed by DHCP.

Lesson: MAC addresses, ARP, DHCP and NAT

Computer Networks

1.What is the OSI model?

2.What is the difference between the OSI and TCP/IP models?

3.What is encapsulation in networking?

4.What does the data link layer do?

5.What does the network layer do?

6.What does the transport layer do?

7.What do the session and presentation layers do?

8.What does the application layer do?

9.What is decapsulation?

10.At which layer does a switch work, and a router?

11.Where does HTTPS fit in these models?

12.Which layer would you check first if a website does not open?

13.Why is ARP hard to place on one layer?

14.Which layer handles error detection?

15.Which layers does a router use, and which does a switch use?

16.What is a port number and at which layer does it belong?

17.Is TCP/IP five layers or four?

18.Why did OSI not become the internet standard?

19.Which layer does a firewall work at?

20.A user can ping 8.8.8.8 but cannot open google.com. Which layer is the problem most likely at?

21.Explain how a web request goes down and up the stack.

22.What is an IP address?

23.What is an octet?

24.What are the IPv4 classes?

25.What is a subnet mask?

26.What is the network address of a subnet?

27.What is the broadcast address?

28.What is the formula for usable hosts?

29.How do you find the network address quickly?

30.What is subnetting and why do we do it?

31.How many usable hosts are in a /26, and why?

32.What is CIDR, and why did it replace classes?

33.What is 127.0.0.1?

34.Why do we need IPv6?

35.What is the default gateway?

36.How can a host tell if a destination is on its own subnet?

37.What are 0.0.0.0 and 255.255.255.255 used for?

38.What is APIPA or 169.254.x.x?

39.What is supernetting or route aggregation?

40.How many subnets do you get by borrowing 3 bits from a /24, and how many hosts each?

41.Is 192.168.1.0/24 a valid host address?

42.Are 10.1.1.10/24 and 10.1.2.10/24 in the same subnet? What about with /16?

43.A /30 is often used between two routers. Why?

44.You need 1,000 hosts in one subnet. Which prefix do you choose?

45.What is a MAC address?

46.Can a MAC address change?

47.What is the broadcast MAC address?

48.Is an ARP request broadcast or unicast? And the reply?

49.What is the ARP cache and how can you see it?

50.What is the difference between a MAC address and an IP address?

51.What is the difference between ARP and DNS?

52.Explain DHCP.

53.What is NAT, and why is it used?

54.Can an attacker fake ARP replies? What happens?

55.Why can't my friend open the server running on my home laptop?

56.What happens if the DHCP server is down when you connect?

57.What is RARP and why is it not used now?

58.What is a DHCP lease, and what happens when it ends?

59.Why is the DHCP Discover a broadcast?

60.What is a DHCP reservation?

Related guides

Learn it, then practise it

Computer Networks

1.What is the OSI model?

2.What is the difference between the OSI and TCP/IP models?

3.What is encapsulation in networking?

4.What does the data link layer do?

5.What does the network layer do?

6.What does the transport layer do?

7.What do the session and presentation layers do?

8.What does the application layer do?

9.What is decapsulation?

10.At which layer does a switch work, and a router?

11.Where does HTTPS fit in these models?

12.Which layer would you check first if a website does not open?

13.Why is ARP hard to place on one layer?

14.Which layer handles error detection?

15.Which layers does a router use, and which does a switch use?

16.What is a port number and at which layer does it belong?