50 Computer Networks Interview Questions (With Answers)

Computer networks interviews test your understanding of protocols, architectures, and how data actually moves across the internet. This guide covers the 50 most common questions with concise, accurate answers — from OSI basics to TCP/IP internals, DNS, routing, and network security.

Quick reference

OSI Model & Layered Architecture

1. What is the OSI model and why does it matter?

The OSI (Open Systems Interconnection) model is a 7-layer framework that standardises how different network systems communicate. Each layer handles a specific responsibility and communicates only with the layers directly above and below it.

Why it matters: OSI gives engineers a common vocabulary for troubleshooting. "Layer 3 issue" immediately points to IP routing; "Layer 2 issue" points to MAC/switching.

2. What is encapsulation in networking?

Encapsulation is the process of adding a header (and sometimes trailer) at each OSI layer as data travels down the stack from sender to receiver.

Application data
  → Transport adds TCP header          → Segment
  → Network adds IP header             → Packet
  → Data Link adds Ethernet header+FCS → Frame
  → Physical transmits as bits

On the receiving side, each layer de-encapsulates (strips its header) and passes data up. This is why you can change the transport protocol (TCP→UDP) without touching the application layer.

3. What is the difference between the OSI model and the TCP/IP model?

TCP/IP layers: Application → Transport → Internet → Network Access

4. What is a PDU (Protocol Data Unit)?

A PDU is the unit of data at each OSI layer:

TCP/IP and Transport Layer

5. What is the difference between TCP and UDP?

Rule of thumb: Use TCP when correctness matters, UDP when speed matters and occasional loss is acceptable.

6. Explain the TCP three-way handshake.

The three-way handshake establishes a TCP connection before data transfer:

Client                    Server
  |                          |
  |------- SYN (seq=x) ----->|   Client wants to connect
  |                          |
  |<---- SYN-ACK (seq=y, ack=x+1) ---|  Server accepts
  |                          |
  |------- ACK (ack=y+1) --->|   Client confirms
  |                          |
  |<======= DATA ============|   Connection established

• SYN — synchronise sequence numbers
• SYN-ACK — server acknowledges and sends its own sequence number
• ACK — client acknowledges server's sequence number

7. How does TCP connection termination work (four-way handshake)?

Client                    Server
  |                          |
  |------- FIN (seq=x) ----->|   Client done sending
  |<------- ACK (ack=x+1) ---|   Server acknowledges
  |                          |   (server may still send data)
  |<------- FIN (seq=y) -----|   Server done sending
  |------- ACK (ack=y+1) --->|   Client acknowledges
  |                          |
  [Client enters TIME_WAIT for 2×MSL]

The TIME_WAIT state ensures delayed packets don't interfere with a new connection on the same port.

8. What is flow control in TCP? What is the sliding window?

Flow control prevents the sender from overwhelming the receiver's buffer.

The receiver advertises a receive window (rwnd) — how many bytes it can accept without ACK. The sender limits unacknowledged data to min(cwnd, rwnd) where cwnd is the congestion window.

Sliding window: As ACKs arrive, the window "slides" forward, allowing more data to be sent without waiting for all outstanding data to be acknowledged. This enables pipelining and maximises throughput.

9. What is TCP congestion control?

TCP uses four algorithms to avoid network congestion:

Modern variants: CUBIC (Linux default), BBR (Google, bandwidth-delay product based).

10. What is a port number? What are well-known ports?

A port is a 16-bit number (0–65535) that identifies a specific process on a host. Combined with an IP address it forms a socket.

IP Addressing and Subnetting

11. What is the difference between IPv4 and IPv6?

12. What is CIDR and how does subnetting work?

CIDR (Classless Inter-Domain Routing) replaces classful addressing with flexible prefix lengths.

192.168.1.0/24 means:

• Network prefix: first 24 bits → 192.168.1
• Host portion: last 8 bits → .0 to .255
• Usable hosts: 2^8 − 2 = 254 (subtract network + broadcast)

Subnetting example — dividing 192.168.1.0/24 into 4 subnets:

Formula: Hosts per subnet = 2^(32 − prefix) − 2

13. What are private IP address ranges?

Defined by RFC 1918, these ranges are not routable on the public internet:

14. What is NAT (Network Address Translation)?

NAT maps private IP addresses to one (or more) public IPs, enabling multiple devices to share a single public IP.

Internal LAN            NAT Router              Internet
192.168.1.10:54321  →  203.0.113.5:43210  →  Server
192.168.1.11:54322  →  203.0.113.5:43211  →  Server

Types:

• Static NAT — 1:1 mapping (one private ↔ one public)
• Dynamic NAT — pool of public IPs
• PAT/NAPT (Port Address Translation) — many:1 (most common, "overloading")

Drawback: NAT breaks end-to-end connectivity and complicates P2P, VoIP, and some protocols. IPv6 eliminates the need for NAT.

15. What is the difference between a public and private IP address?

DNS (Domain Name System)

16. How does DNS resolution work step by step?

When you type example.com:

Browser → OS cache → /etc/hosts → Recursive Resolver (ISP)
  → Root nameserver (knows .com TLD server)
  → TLD nameserver (.com) (knows example.com authoritative NS)
  → Authoritative nameserver (returns A record: 93.184.216.34)
  → Recursive resolver caches result (TTL)
  → Browser receives IP → TCP connection → HTTP request

Total time: 50–200ms uncached, ~0ms cached.

17. What are the main DNS record types?

18. What is DNS TTL and DNS caching?

TTL (Time To Live) is the number of seconds a DNS record can be cached by resolvers and clients.

• Low TTL (60–300s): changes propagate fast; more DNS queries (higher load)
• High TTL (3600–86400s): fewer queries; changes take longer to propagate

Caching layers:

1. Browser cache
2. OS resolver cache
3. Recursive resolver (ISP/Google/Cloudflare)
4. Authoritative nameserver

Flush DNS: ipconfig /flushdns (Windows), sudo systemd-resolve --flush-caches (Linux)

19. What is the difference between authoritative and recursive DNS?

20. What is DNS over HTTPS (DoH) and why does it matter?

Traditional DNS sends queries in plain text over UDP port 53 — visible to ISPs, on-path attackers, and network admins.

DoH encrypts DNS queries inside HTTPS (port 443), preventing eavesdropping and tampering. DoT (DNS over TLS) does the same over TLS on port 853.

Trade-off: Improves privacy; reduces network-admin visibility into DNS traffic; shifts trust from ISP to DoH provider.

HTTP, HTTPS, and Application Protocols

21. What are the HTTP methods and when do you use each?

Idempotent = calling the same request multiple times has the same effect as calling it once.

22. What do common HTTP status codes mean?

23. What is HTTPS and how does TLS work?

HTTPS = HTTP + TLS (Transport Layer Security). TLS encrypts the connection between client and server.

TLS 1.3 handshake:

Client                                Server
  |                                      |
  |------ ClientHello (supported ciphers, key share) --->|
  |<----- ServerHello + Certificate + Finished ----------|
  |------ Finished (client auth optional) -------------->|
  |<============ Encrypted Application Data ============>|

TLS 1.3 completes in 1 RTT (vs 2 RTT for TLS 1.2).

What TLS provides:

• Confidentiality — data encrypted with symmetric key derived from handshake
• Integrity — HMAC prevents tampering
• Authentication — server certificate verified against CA chain

24. What is the difference between HTTP/1.1, HTTP/2, and HTTP/3?

25. What is CORS (Cross-Origin Resource Sharing)?

CORS is a browser security mechanism that restricts cross-origin HTTP requests (requests from origin-a.com to origin-b.com).

Preflight flow:

Browser → OPTIONS /api/data (Origin: app.com, Access-Control-Request-Method: POST)
Server  ← Access-Control-Allow-Origin: app.com, Access-Control-Allow-Methods: POST
Browser → POST /api/data (actual request)

Server headers:

Access-Control-Allow-Origin: https://app.com
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

CORS is enforced by browsers, not servers. Server-side requests (curl, Node.js) are not affected.

Network Devices

26. What is the difference between a hub, switch, and router?

Hub is obsolete. Switch builds a CAM (MAC address) table. Router connects different networks and segments broadcast domains.

27. What is a MAC address?

A MAC (Media Access Control) address is a 48-bit hardware identifier assigned to a network interface card (NIC).

Format: 00:1A:2B:3C:4D:5E (6 octets, colon-separated hex)
         ←OUI (vendor)→ ←Device ID→

• OUI (Organizationally Unique Identifier): first 3 bytes, assigned to manufacturers
• Burned in to NIC hardware, but can be spoofed in software
• Used at Layer 2 (within a LAN segment); replaced by IP at Layer 3

28. What is ARP (Address Resolution Protocol)?

ARP maps IP addresses to MAC addresses within the same LAN.

Host A wants to send to 192.168.1.5:
1. Checks ARP cache — not found
2. Broadcasts ARP Request: "Who has 192.168.1.5? Tell 192.168.1.1"
3. Host B (192.168.1.5) replies with its MAC: "I have .5, my MAC is aa:bb:cc:dd:ee:ff"
4. Host A caches IP→MAC mapping, sends frame

ARP cache poisoning: Attacker sends fake ARP replies to redirect traffic (MITM attack). Mitigated by Dynamic ARP Inspection (DAI) on managed switches.

29. What is a VLAN?

A VLAN (Virtual LAN) logically divides a physical switch into multiple isolated broadcast domains without requiring separate physical hardware.

Benefits:

• Security isolation (HR traffic separate from engineering)
• Reduces broadcast traffic
• Simplifies network management

Trunk ports carry traffic for multiple VLANs (tagged with 802.1Q headers). Access ports carry a single VLAN (untagged to end devices).

30. What is a firewall and what types exist?

A firewall filters network traffic based on rules (ACLs).

Default deny: only explicitly allowed traffic passes. Everything else is blocked.

Routing and Switching

31. What is a routing table and how does it work?

A routing table is a database in a router that maps destination networks to next-hop addresses or outgoing interfaces.

Destination      Gateway        Interface
0.0.0.0/0        10.0.0.1       eth0       ← default route
192.168.1.0/24   0.0.0.0        eth1       ← directly connected
10.10.0.0/16     192.168.1.254  eth1       ← static/dynamic route

Longest prefix match: Router chooses the most specific (longest) matching prefix. A /24 beats a /16 for the same destination.

32. What is the difference between static and dynamic routing?

33. What is OSPF?

OSPF (Open Shortest Path First) is a link-state routing protocol that uses Dijkstra's SPF algorithm to calculate the shortest path tree.

How it works:

1. Routers discover neighbours via Hello packets
2. Exchange LSAs (Link State Advertisements) — describe their links and costs
3. Each router builds a complete topology map (LSDB)
4. Runs SPF to calculate best paths
5. Installs best paths in routing table

Key concepts: Areas (Area 0 = backbone), DR/BDR election on multi-access segments, cost = 10^8 / bandwidth.

34. What is BGP?

BGP (Border Gateway Protocol) is the routing protocol of the internet — it exchanges routing information between autonomous systems (ASes).

• eBGP — between different ASes (Internet backbone)
• iBGP — within the same AS

BGP is a path-vector protocol: it chooses routes based on path attributes (AS-PATH, LOCAL_PREF, MED, NEXT_HOP) rather than just cost.

Why BGP matters: Every ISP, cloud provider, and large network uses BGP. Route leaks and hijacks (incorrect BGP announcements) can cause internet outages.

35. What is the difference between distance-vector and link-state routing protocols?

Network Security

36. What is a VPN and how does it work?

A VPN (Virtual Private Network) creates an encrypted tunnel over a public network, making traffic appear to originate from the VPN server.

Types:

• Site-to-site VPN — connects two networks (office to data center) using IPsec
• Remote access VPN — connects individual devices (OpenVPN, WireGuard, Cisco AnyConnect)

IPsec modes:

• Tunnel mode — encrypts entire IP packet (used in site-to-site VPN)
• Transport mode — encrypts payload only (used between hosts)

WireGuard (modern) vs OpenVPN (mature, flexible) vs IPsec (enterprise standard).

37. What is a DDoS attack and how is it mitigated?

DDoS (Distributed Denial of Service) floods a target with traffic from many sources, exhausting bandwidth or CPU.

Mitigation:

• Rate limiting and traffic scrubbing (Cloudflare, AWS Shield)
• Anycast diffusion — distribute traffic across many PoPs
• BGP blackholing — drop traffic at upstream provider
• CAPTCHAs, WAF rules at Layer 7
• Over-provision capacity (CDN)

38. What is a man-in-the-middle (MITM) attack?

In a MITM attack, an attacker secretly intercepts and potentially alters communication between two parties.

Techniques:

• ARP poisoning — redirect LAN traffic through attacker
• DNS spoofing — return fake IP for domain
• SSL stripping — downgrade HTTPS to HTTP
• Evil twin Wi-Fi — fake access point

Defences:

• HTTPS everywhere (TLS + certificate pinning)
• HSTS (HTTP Strict Transport Security)
• DNSSEC
• MFA (attacker needs live session to exploit)

39. What is TLS certificate pinning?

Certificate pinning hard-codes a specific certificate or public key hash in the client application. Even if an attacker has a CA-signed certificate, it won't match the pinned value.

Used in mobile apps to prevent MITM via rogue CAs. Trade-off: certificate rotation breaks the app if pins aren't updated.

40. What is network segmentation and why is it important?

Network segmentation divides a network into isolated zones so a breach in one zone can't directly spread to others.

Common segments:

Internet → DMZ (web servers, load balancers)
         → Internal LAN (office devices)
         → Secure zone (databases, HR systems)
         → OT/IoT zone (industrial, smart devices)

Techniques: VLANs, firewalls between segments, micro-segmentation (per-workload in cloud).

Zero Trust: "Never trust, always verify" — treat every segment, user, and device as untrusted even inside the network.

Advanced Topics

41. What is the difference between latency and bandwidth?

High bandwidth + high latency = fast downloads, slow interactive response (satellite internet).

42. What is CDN (Content Delivery Network)?

A CDN is a geographically distributed network of cache servers that delivers content from the location closest to the user.

How it works:

1. DNS returns the CDN edge server IP nearest to the client
2. Edge serves cached static content (images, JS, CSS, video)
3. Cache miss → edge fetches from origin → caches and serves

Benefits: Reduced latency, lower origin load, DDoS protection, TLS termination at edge. Examples: Cloudflare, AWS CloudFront, Akamai, Fastly.

43. What is load balancing and what algorithms are used?

A load balancer distributes incoming requests across multiple backend servers.

Layer 4 LB: TCP/UDP — fast, no content inspection. Layer 7 LB: HTTP — can route by URL path, headers, cookies (e.g., Nginx, HAProxy, AWS ALB).

44. What is DHCP and how does DORA work?

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to clients.

DORA process (UDP, ports 67/68):

Client (0.0.0.0) → DHCP Discover (broadcast)     → All hosts
Client           ← DHCP Offer (IP offered)        ← DHCP server
Client (0.0.0.0) → DHCP Request (accept offer)   → All hosts
Client           ← DHCP Acknowledge (confirmed)   ← DHCP server
Client now has IP, mask, gateway, DNS for lease duration

Lease renewal: Client requests renewal at 50% of lease time (T1), then 87.5% (T2).

45. What is ICMP and what is it used for?

ICMP (Internet Control Message Protocol) is a network-layer protocol used for error reporting and diagnostics — not data transfer.

traceroute uses ICMP TTL: Sends packets with TTL=1, 2, 3... Each router decrements TTL; when it hits 0, router returns "Time Exceeded" revealing its IP.

46. What is MTU and what is Path MTU Discovery?

MTU (Maximum Transmission Unit) is the largest packet size a network link can carry. Ethernet MTU = 1500 bytes. Jumbo frames = up to 9000 bytes (needs end-to-end support).

If a packet exceeds the MTU of a link, it must be fragmented (IPv4) or the sender must reduce packet size (IPv6 — no fragmentation by routers).

Path MTU Discovery (PMTUD):

1. Sender sends packets with DF (Don't Fragment) bit set
2. Router that can't forward returns ICMP "Fragmentation Needed" with allowed MTU
3. Sender reduces packet size

PMTUD black hole: Firewall blocks ICMP → sender never learns MTU → connection hangs. Fix: TCP MSS clamping.

47. What is the difference between unicast, multicast, and broadcast?

IPv6 eliminates broadcast — uses multicast instead (link-local multicast FF02::1).

48. What is a proxy server and how does it differ from a reverse proxy?

Forward proxy: client configures proxy explicitly (or transparent proxy in network path). Reverse proxy: client talks to proxy thinking it's the server; proxy routes to backends.

49. What is QoS (Quality of Service)?

QoS prioritises certain traffic to ensure performance guarantees for latency-sensitive applications.

Mechanisms:

Typical QoS classes: VoIP > Video conferencing > Business-critical apps > General web > Bulk transfers.

50. How does a three-tier network architecture work?

The three-tier architecture is the classic enterprise network design:

┌─────────────────────────────────────────┐
│          Core Layer                      │
│   (high-speed backbone, L3 routing)      │
│   Cisco Catalyst 9500 / Nexus 9000       │
└──────────────┬──────────────────────────┘
               │  high-speed uplinks
┌──────────────┴──────────────────────────┐
│         Distribution Layer               │
│   (inter-VLAN routing, ACLs, QoS,        │
│    redundancy via HSRP/VRRP)             │
└────────┬────────────────┬───────────────┘
         │                │
┌────────┴──────┐  ┌──────┴────────┐
│  Access Layer  │  │  Access Layer │
│ (edge switches,│  │ (edge switches│
│  PoE, VLANs,  │  │  per floor/   │
│  endpoints)    │  │  building)    │
└────────────────┘  └───────────────┘

Modern alternative: Spine-Leaf (data centers) — every leaf connects to every spine, no more than 2 hops between any servers.

Common mistakes

Computer networks vs related concepts

Frequently asked questions

Q: What is the difference between a collision domain and a broadcast domain? A collision domain is a network segment where two devices can transmit simultaneously and cause a collision — each switch port is its own collision domain. A broadcast domain is the set of devices that receive a Layer 2 broadcast (ARP, DHCP) — bounded by routers or VLANs.

Q: What happens when you type google.com in a browser? Browser checks cache → OS DNS resolver → recursive DNS query → IP obtained → TCP three-way handshake → TLS handshake → HTTP GET request → server responds → browser renders page. This covers nearly every networking concept in one question.

Q: What is the difference between a circuit-switched and packet-switched network? Circuit-switched (traditional telephone) reserves a dedicated path for the duration of a call — guaranteed bandwidth but wasteful. Packet-switched (internet) breaks data into packets that share links dynamically — efficient but no guarantees. Modern VoIP uses packet switching with QoS to emulate circuit quality.

Q: How does Wi-Fi work at the protocol level? Wi-Fi uses IEEE 802.11 standards (a/b/g/n/ac/ax/be). Devices share a radio frequency medium using CSMA/CA (listen before transmit, random backoff on collision). Access points bridge wireless to wired Ethernet. 802.11 frames have source MAC, destination MAC, and BSS ID (AP MAC). WPA3 handles authentication and encryption.

Q: What is the difference between TCP keepalive and HTTP keepalive? TCP keepalive sends small probe packets on idle connections to detect dead peers (disabled by default, ~2 hours). HTTP keepalive (Connection: keep-alive) reuses the same TCP connection for multiple HTTP requests, avoiding repeated handshakes — standard in HTTP/1.1+.

Q: What is anycast and how do DNS root servers use it? Anycast assigns the same IP to multiple servers in different locations. BGP routing directs each client to the topologically nearest server. The 13 DNS root server names (a.root-servers.net through m.root-servers.net) resolve to anycast addresses — there are actually 1700+ physical instances worldwide, all sharing the same IPs.