Networking Interview Questions and Answers for 2026

Answer: An agreed message format plus rules for exchanging it, so programs from different vendors interoperate without knowing each other’s internals. HTTP defines requests and responses, TCP defines reliable byte streams, DNS defines name queries. The consequence worth stating: protocols are contracts, and when debugging you compare what one side actually sends against what the contract says, which is why reading a capture beats guessing. Follow-up networking interview questions almost always drill into one protocol’s specific rules.

Answer: An IP address identifies an interface on a network, not a machine: one host with three NICs has three addresses. IPv4 uses 32-bit numbers written as four octets, like 10.0.5.20, and the address plus its prefix tells the host which neighbors are local. The beginner trap: addresses are leased and reusable, so logs keyed on IP alone can mix different users over time. That interface distinction is the first precision check in networking interview questions.

Answer: IPv4 has 32-bit addresses, about 4.3 billion, exhausted for years; IPv6 has 128-bit addresses written as hex groups, like 2001:db8::8a2e:370:7334, removes the need for NAT, and autoconfigures with SLAAC. The gap persists because NAT made IPv4 livable and upgrades cost coordination, not because IPv6 is hard. Production is dual-stack, running both, and an IPv6-only service is invisible to IPv4-only clients, which is how teams quietly hide their site from part of the internet.

Answer: A MAC address is the hardware identifier of a NIC, 48 bits like aa:bb:cc:11:22:33, used for delivery inside one local network segment. The IP address routes between networks and changes as the host moves; the MAC is local-only and is rewritten at every router hop. The shorthand that lands: IP gets the packet across the internet, MAC gets it across the room.

Answer: A port is a 16-bit number that multiplexes many conversations over one IP address: the kernel delivers each packet to the socket bound to its port, like apartment numbers in one building. Servers listen on well-known ports, 443 for HTTPS, 22 for SSH, while clients use ephemeral ports for replies. That pairing, destination port plus ephemeral source port, is how one load balancer serves thousands of simultaneous clients.

Answer: They are the privileged range: binding one historically required root, so users could not impersonate system services like SSH on 22 or HTTPS on 443. Modern Linux splits the power with capabilities, so CAP_NET_BIND_SERVICE lets a service bind low ports without running as root. Most stacks now front low ports with a proxy or grant the capability, and naming that shift is the detail that upgrades this answer.

Answer: DNS converts names people remember into IP addresses machines need, through a distributed hierarchy of zones run by independent operators. It is also a general directory: MX points at mail servers, TXT carries verification and anti-spoofing records, PTR reverses addresses to names. Consequence: nearly every outage that is not the network turns out to be DNS, which is why networking interview questions treat name-resolution fluency as a core survival skill.

Answer: An A record maps a name directly to an IPv4 address; AAAA is the IPv6 twin. A CNAME maps a name to another name, so www can alias to a load balancer hostname that holds the A record. Two rules matter in practice: the zone apex usually cannot hold a CNAME beside its SOA and NS records, which is why providers invented ALIAS-style extensions, and every CNAME adds one resolution hop with its own TTL.

Answer: DHCP hands a joining host its network identity: IP address, subnet mask, default gateway, and DNS servers, for a lease time the client renews. The exchange is discover, offer, request, acknowledge, broadcast on the local segment. Consequence: a dead DHCP server is invisible until leases expire, then devices silently fall off the network, which is why servers get static reservations and lease pools get monitored.

Answer: The prefix length splits an address into network part and host part: /24 means the first 24 bits are the network, leaving 8 host bits, 256 addresses, 254 usable once network and broadcast are reserved. Hosts in the same network talk directly via ARP; anything else goes to the gateway. Computing hosts as two to the power of host bits minus two, on demand, is the arithmetic networking interview questions expect instantly.

Answer: It is the router a host sends traffic to when the destination is not on any local subnet, visible as the default via 10.0.0.1 line in the routing table. Without it, a host reaches its own subnet and nothing else, the classic symptom when DHCP hands out an address but no router. A quick flourish: ip route get 8.8.8.8 shows exactly which gateway your traffic would take.

Answer: RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private use; they are not routable on the public internet, and every organization reuses them, so 10.0.0.5 means nothing globally. Add loopback 127.0.0.0/8 and link-local 169.254.0.0/16 for the full set. Consequence: private space must be NATed to reach the internet, and overlap between networks is a landmine, a recurring theme in networking interview questions about cloud VPCs.

Answer: Network address translation lets many private addresses share one public IP: the router rewrites source address and port on the way out, remembers each mapping in a table, and rewrites replies back. IPv4 scarcity made it universal. The operational consequences interviewers probe: inbound connections need explicit port forwarding, hosts behind NAT are hidden, and a thousand users can share one source IP, which breaks peer-to-peer designs and muddies logs.

Answer: A switch forwards frames inside one network using a MAC address table; a router forwards packets between networks using IP routing tables, and each router hop decrements TTL and rewrites the frame’s MAC headers. The blur worth acknowledging: modern gear does both, and a layer 3 switch routes between VLANs in silicon. Frames inside a segment, packets between segments: that sentence is what interviewers want.

Answer: Address Resolution Protocol answers one local question: who has this IP? The owner replies with its MAC, the host caches the pair, and you can read the cache with ip neigh. It only works inside a subnet, because routers do not forward ARP. The debugging hook: a stale ARP entry after a failover keeps serving the old hardware’s address, which is why VIP failovers send gratuitous ARP to refresh every neighbor’s cache.

Answer: ICMP is IP’s control protocol: error messages, diagnostics, and the echo request and reply that ping uses. Ping’s round-trip time measures path latency to an address, nothing more: a reply proves IP reachability for ICMP and nothing about TCP ports, because firewalls routinely pass TCP while filtering ICMP. That asymmetry, ping succeeding means little and ping failing means investigate, is the takeaway networking interview questions grade here.

Answer: It maps the routers on a path by sending probes with ascending TTL values: each router that expires a probe returns an ICMP time-exceeded message naming itself, so hop one is your gateway, hop two the next router, and per-hop timing shows where latency appears. The caveat that earns credit: some routers deprioritize these replies, so a line of stars means no answer, not necessarily a black hole.

Answer: Every byte gets a sequence number, the receiver acknowledges what arrived, and the sender retransmits anything unacknowledged, while checksums catch corruption and duplicates are discarded. Ordering, retransmission, and integrity are the three pillars. The consequence: TCP delivers your bytes completely or not at all, and not at all looks like a hang, which is why retransmission questions open most intermediate networking interview questions.

Answer: UDP is IP plus ports and a checksum and nothing else: no handshake, no ordering, no retransmission. Choose it when latency beats completeness: DNS retries cheaply at the application layer, video calls prefer fresh frames over perfect ones, games send state that is stale anyway, and QUIC builds its own reliability on top where needed. The tradeoff sentence: picking UDP means you now own congestion control and retransmission yourself.

Answer: A socket is one endpoint of a conversation: an address, a port, and a protocol, held by the kernel and used by the process as a file descriptor. A listening TCP socket is bound and accepting; an established one is a four-tuple of source IP, source port, destination IP, destination port. That tuple is why one server on port 443 serves thousands of clients at once: each connection’s tuple is unique even though the destination half is shared.

Answer: Each layer wraps the one above: application data goes into a TCP segment with ports and sequence numbers, that segment into an IP packet with addresses, that packet into a frame with MACs and a checksum; receivers unwrap in reverse. The number that matters: Ethernet’s typical 1500-byte MTU caps the whole stack, so an HTTPS packet carries at most about 1460 bytes of TLS and HTTP payload. That arithmetic is what MTU questions build on.

Answer: A seven-layer teaching model, physical through application, that nobody implements literally; real stacks are the TCP/IP five. Its surviving value is triage vocabulary: saying this is a layer 2 problem, not layer 3 instantly narrows the search from ARP and switch ports to routing and firewalls. Interviewers use it as a sorting hat: reciting the layers is table stakes, using them to structure a diagnosis is the pass, and that usage is what networking interview questions at every level reward.

Answer: HTTPS is HTTP inside a TLS tunnel: same verbs, headers, and semantics, but encrypted, authenticated by the server’s certificate, and integrity-protected. The default port moves from 80 to 443. Consequences that matter operationally: intermediate devices can no longer read or rewrite the traffic and see only hostnames via SNI, and anything doing inspection must become a TLS-terminating endpoint with its own certificate.

Answer: 2xx succeeded, 200 for a normal GET; 3xx redirect or cache signal, 301 permanent versus 302 temporary; 4xx the client’s fault, with 403 forbidden versus 404 missing and 429 rate limited; 5xx the server’s fault, where 502 bad gateway and 504 gateway timeout are the ops-critical pair meaning the proxy could not reach or wait for its backend. Sorting any error into whose fault and which layer is the reflex these families exist to build, and it is the shape most networking interview questions about HTTP take.

Answer: Bandwidth is capacity, how many bits per second the pipe carries; latency is delay, how long one packet takes to cross. They compound badly: a high-bandwidth, high-latency link feels awful interactively because every round trip, DNS, TCP handshake, TLS, request, pays the delay. Add the precision point that RTT is round trip, and that measured throughput is always below bandwidth because of overhead, loss, and queueing.

Answer: Loopback is the 127.0.0.0/8 range with 127.0.0.1 conventional and localhost its name: the traffic never leaves the kernel, so it is immune to firewalls, MTU, and cables, ideal for local IPC. Two details worth having: ::1 is the IPv6 form and a service bound to only one of the two mysteriously refuses the other, and a listener on 127.0.0.1 is unreachable from other machines by design, the answer to half of all container connection tickets.

Answer: A firewall filters traffic by rules: interface, source and destination, ports, protocol, connection state, with an action of allow, drop, or reject. Modern Linux stacks are stateful via conntrack, so allowing outbound 443 automatically admits the replies. Volunteer the distinction: drop discards silently so clients time out, reject answers so clients fail fast, and choosing between them changes the symptoms you will debug later, a tradeoff networking interview questions like hearing spelled out.

Answer: A NAT rule that publishes an internal service: inbound traffic to public-ip:2222 is rewritten to 10.0.0.8:22 and tracked on the way back. It is how self-hosted services survive behind one shared IP. The caveats: the forward bypasses nothing about the target’s own firewall, exposure is found by scanners within hours, and the professional default is a VPN or tunnel rather than one more open port on the internet.

Answer: Refused means your packet reached a host and something answered nothing listens here: a TCP RST came back, so DNS, routing, and the host all work. A timeout means silence: packets left and nothing returned, pointing at filtering, a dead path, or an overloaded listener. The triage value is the whole point: refused points at the service, timeout points at the path, and that one distinction forks the investigation correctly.

Answer: nc -vz host 22 for a quick TCP probe, curl -v telnet://host:22 or bash’s /dev/tcp when nc is missing, and nmap -p 22,80,443 host for ranges with service detection. Read results precisely: open, closed meaning refused with RST, and filtered meaning no reply, are three different answers about three different layers. On the box itself, ss -tlnp answers the inverse question: what is listening, and who owns it.

Answer: Every layer caches answers for the record’s TTL: the OS stub, the recursive resolver, often the browser. Flushing discards locally held answers and forces fresh queries, the standard first move after a DNS change. The nuance that separates practitioners: you control only your own caches, and the recursive resolver’s copy survives your flush until its TTL expires, which is exactly why I fixed DNS and everyone can see the fix are different moments, and why DNS networking interview questions keep returning to TTLs.

Answer: A fully qualified domain name is the complete path from hostname to root, like app01.eu-west.example.com., terminating at the root dot that is usually elided. It matters because search domains in /etc/resolv.conf turn partial names into guesses: a short name can resolve differently depending on suffix order. Automation and service discovery should always use FQDNs, because ambiguous short names generate quiet works here, fails there tickets.

Answer: 0.0.0.0/0 is the route that matches every destination, the fallthrough when no more specific route applies, normally pointing at your gateway. Routing is longest-prefix-match, so a /24 always beats the /0. The classic incident: two default routes with different metrics after a config change flap traffic between uplinks, or no default route at all after a DHCP hiccup leaves the host able to reach its subnet and nothing else.

Answer: It builds an encrypted tunnel between your device and a gateway: packets are encapsulated inside WireGuard, TLS, or IPsec, carried across the hostile network, decapsulated at the far end, and routed as if you were physically there. Split tunnel sends only corporate ranges through; full tunnel takes everything. Consequences to mention: MTU shrinks inside the tunnel and DNS usually gets pulled to corporate resolvers, and both generate support tickets.

Answer: A forward proxy sits in front of clients: the client is configured to send requests to it, and it fetches, caches, filters, and forwards on the client’s behalf, so origins see the proxy rather than the user. Enterprises use it for egress control, filtering, and caching. The interview angle: a proxy is both a control point and a failure point, and TLS turns it into a CONNECT tunnel relay that sees hostnames but not content, a distinction that anchors networking interview questions about proxies.

Answer: A reverse proxy sits in front of servers: clients hit it, and it routes, terminates TLS, caches, rate limits, and load balances on behalf of the backend pool; nginx, HAProxy, and every cloud load balancer are this. Client-facing consequences: backends see the proxy’s IP unless headers like X-Forwarded-For are trusted, and certificates live at the proxy. It is the mirror of the forward proxy, and naming which side each serves is the point of the question.

Answer: The kernel object connecting the stack to a network: eth0 or ens5 for physical NICs, lo for loopback, plus virtual kinds, veth pairs for containers, bridges for switching, tunnels, and VLAN subinterfaces. Inspect with ip -br addr and ip link. The container connection worth making: a veth pair is a virtual cable, one end in the container’s namespace and one on the host bridge, so container networking questions reduce to ordinary interface questions.

Answer: When logs and metrics disagree with reality: is the SYN arriving, who resets, are there retransmissions, does the server reply at all. tcpdump -ni eth0 port 443 filters on the box, and -w writes a file for Wireshark’s full decode. The discipline interviewers want stated: capture on the right hop, keep filters narrow, and remember TLS shows metadata only, handshakes and resets, never content, which is usually exactly what networking interview questions about captures are asking whether you can interpret.

Answer: The client sends SYN with a random initial sequence number, the server replies SYN-ACK acknowledging it and choosing its own, the client ACKs the server’s number. Three is the minimum: each side must transmit a sequence number and hear it acknowledged, and no two-packet exchange proves both directions work. Operationally, SYNs land in the kernel’s SYN queue and completed handshakes move to the accept queue the app drains with accept(), so a connect that succeeds while the app stalls points at queue limits, a favorite follow-up in networking interview questions.

Answer: A clean close is four packets: each side sends FIN when it has no more data and ACKs the peer’s FIN, and the two directions close independently, which permits a half-open state where one side still transmits. RST is the abort: sent on a packet for a closed port, on protocol violations, or by firewalls configured to reject, and it discards buffered data immediately. Clean FIN sequencing is what makes TIME_WAIT meaningful; RST skips it entirely, which is why reset storms skip the polite queues too.

Answer: TIME_WAIT is held by the side that closed first, for twice the maximum segment lifetime, so a retransmitted final ACK can be answered and old segments die off; lots of it usually just means lots of short-lived outbound connections. CLOSE_WAIT is held by the side that received a FIN whose application never called close(); thousands of them mean an application bug, not kernel tuning. Reading them is diagnostic gold: TIME_WAIT points at churn, CLOSE_WAIT points at a leak, and that split is precisely what networking interview questions on TCP states are after.

Answer: Flow control protects the receiver: the advertised receive window caps how much the peer may send. Congestion control protects the network: the congestion window grows with slow start, collapses on loss or delay signals, and probes upward again, because routers, not endpoints, are what fills. They multiply to cap data in flight. The modern nuance: loss-based algorithms misread bloomed buffers as congestion, which is why BBR models bandwidth and RTT instead, a sentence that lands well in senior networking interview questions.

Answer: Retransmissions mean sent segments went unacknowledged: loss on a congested link, a flapping path, or a peer that died mid-conversation. See them per connection with ss -ti under the retrans fields, host-wide with nstat for TcpRetransSegs, or in Wireshark’s expert view. Isolate direction with captures on both ends. The caveat: a few retransmissions under load are normal, TCP is designed for them, so alarm on trends and correlations rather than single digits, which is the judgment layer networking interview questions hunt for.

Answer: The stub resolver asks its configured recursive resolver. Cache miss, so the resolver asks a root server, which does not know the answer but returns the .com TLD servers. The resolver asks a .com server, which returns the domain’s authoritative name servers. The resolver asks one of those, which returns the A record. The resolver caches it for the TTL and answers the client. Every referral in that chain is visible with dig +trace, and narrating it accurately is the body of most networking interview questions on DNS.

Answer: Recursive resolvers do the legwork for clients, walk the delegation chain, and cache answers; ISPs, 8.8.8.8, 1.1.1.1, and your datacenter run them. Authoritative servers own a zone and answer definitively for it, serving whatever you publish. Production runs both: unbound or a cloud resolver in front, Route 53 or a registrar’s NS behind. The follow-up that separates candidates: open recursive resolvers get abused for amplification DDoS, so recursion is restricted to your clients, a hardening point that recurs in networking interview questions on DNS operations.

Answer: A and AAAA for addresses, CNAME for aliasing, MX for mail routing, TXT for SPF, DKIM, and ownership verification, NS for delegation, SOA for zone metadata including the negative-cache TTL, SRV for service discovery, and PTR for reverse lookups that mail servers and log enrichment rely on. CAA, restricting which CAs may issue for the zone, is the modern bonus. Expect follow-up networking interview questions on the apex-CNAME restriction and on why a short SOA TTL speeds NXDOMAIN recovery.

Answer: TTL is how long any cache may reuse an answer, and one answer sits in many caches: browser, OS stub, recursive resolver, sometimes an anycast edge. Change propagation therefore runs at the speed of the longest TTL along each user’s path, so the professional move is dropping TTLs to 60 seconds a day before a cutover and raising them after. Saying you control your record, not the world’s caches is the sentence networking interview questions on propagation are fishing for.

Answer: Split DNS answers differently depending on who asks: internal clients resolve git.company.internal to a private 10.x address, while the public zone never exposes that name. Implement it with views in bind, separate internal and public zones in Route 53, or per-VPC resolver configs. Consequence: testing does the name resolve without saying from where is meaningless, and that vantage-dependence makes split DNS one of the quietly recurring topics in senior networking interview questions.

Answer: DoH and DoT encrypt the resolver conversation: queries ride inside HTTPS on 443 or TLS on 853, so observers on the path see the client talking to a resolver, not which names. Users gain privacy and integrity; network teams lose the visibility and control that plain port 53 provided, so captive portals, filters, and security tools built on DNS interception break. Enterprises either block external DoH endpoints or run their own encrypted resolvers, and both positions are defensible when argued from the tradeoff.

Answer: HTTP/2 keeps the semantics and changes the transport framing: one connection, binary frames, many parallel streams multiplexed over it, plus HPACK header compression, which retires the six-connections-per-origin workaround. Flow control and prioritization move into the protocol. The catch interviewers love: multiplexing removes HTTP-level head-of-line blocking, but TCP still delivers bytes in order, so one lost packet stalls every stream until it is retransmitted, and that residual TCP limitation is exactly the gap HTTP/3 was built to close.

Answer: QUIC is a TCP replacement implemented in user space over UDP: TLS 1.3 is baked into the handshake, streams are independently reliable so a lost packet stalls only its own stream, and connection IDs survive address changes, which is how a download rides through a wifi-to-cellular handover. The protocol evolves with the app, no kernel upgrades needed. UDP was chosen as the carrier because middleboxes already tolerate it, while novel TCP options get blocked routinely.

Answer: It is one blocked item stalling everything behind it: HTTP/1.1 blocks at the request level, so a slow response holds its connection; HTTP/2 removes that but reintroduces it inside TCP, where a single lost segment halts every multiplexed stream; HTTP/3 dissolves it with independent QUIC streams. Loss is the multiplier: around one percent packet loss, HTTP/2 over TCP can underperform HTTP/1.1 with parallel connections, which is the number that makes this question concrete in networking interview questions about protocol choice.

Answer: ClientHello carries the client’s key share and supported groups; ServerHello answers with its own key share, the certificate, and a Finished message, completing key agreement in one flight; the client verifies the chain, sends its Finished, and application data starts immediately, one round trip total. TLS 1.2 needed two full round trips because key exchange and cipher parameters were negotiated in separate steps. Session resumption adds 0-RTT early data, which carries a replay risk, so only idempotent requests belong there.

Answer: The server presents a leaf plus intermediates; the client builds a path to a root already in its trust store, verifies signatures link by link, checks the leaf’s hostname against SAN entries, confirms validity dates, and enforces revocation or OCSP stapling where configured, plus certificate transparency in modern stacks. The production gotcha: servers must send the intermediates, because a missing one verifies on machines with that intermediate cached and fails on fresh clients, which is exactly the works on my laptop, fails in the container symptom.

Answer: Server Name Indication is the hostname the client announces inside the TLS ClientHello, letting one IP on 443 serve many certificates: the edge or nginx picks the cert and route by name. Without it, shared hosting over TLS is impossible. Consequences: hostname-based routing and filtering work even on encrypted traffic, encrypted ClientHello is now closing that visibility window, and clients that omit SNI receive the default certificate, which is the mechanism behind half of all wrong certificate served tickets.

Answer: Mutual TLS makes both sides present certificates: the client proves identity with its own certificate signed by a private CA instead of a password or token. Service meshes use it for workload identity and encryption between pods, regulated APIs use it for partner authentication, and internal tools use it to drop password handling entirely. The operational cost is running a private CA: rotation, revocation, and distribution, which is why mesh-style automatic identity exists, and asking who rotates the client certs is how networking interview questions separate design knowledge from deployment scars.

Answer: Longest prefix match: the kernel scans the routing table for every route whose network contains the destination and picks the most specific, ties broken by metric. 10.244.1.0/24 via 10.0.0.5 beats 10.0.0.0/8 via 10.0.0.1 beats the default route. No match means the packet is dropped and the app sees network unreachable. Policy routing adds a second dimension: multiple tables selected by source address or firewall marks, which is how multi-homed hosts avoid sending replies out the wrong interface.

Answer: ip route get 8.8.8.8 prints exactly what the kernel would do: chosen gateway, egress interface, and the source address that would be used, resolving rules and tables in one line. Variants pin a source, ip route get 10.0.0.5 from 10.244.1.9, to test a specific workload’s path. The habit it demonstrates: instead of eyeballing tables and guessing precedence, ask the kernel the question directly, which is the entire game in the routing portion of networking interview questions.

Answer: Host bits are 32 minus the prefix: a /26 leaves 6 bits, 64 addresses, minus network and broadcast, 62 usable hosts. The general drill: /24 is 256 addresses, and each longer prefix halves it, so /25 is 128, /26 is 64, /27 is 32. Network address is address AND mask, broadcast is network OR inverted mask. Speed is the expectation: cloud interviews hand you a VPC CIDR and ask for four /19s, and hesitation there reads badly, because this arithmetic underlies every subnet question in networking interview questions for infrastructure roles.

Answer: Borrow two bits from the host portion: 192.168.1.0/26, 192.168.1.64/26, 192.168.1.128/26, 192.168.1.192/26, each with 62 usable hosts. State the boundaries out loud: each subnet starts at a multiple of 64 and its broadcast is the address before the next start. The extension interviewers add: now carve an odd split, one /25 plus two /26s, because real address planning is never the even division.

Answer: SNAT rewrites the source address, hiding many hosts behind one, everything a home router or outbound NAT gateway does. DNAT rewrites the destination, publishing an internal service or steering traffic into a backend pool, which is what port forwards and load balancers do; many flows use both. On Linux both are netfilter nat-table rules with conntrack remembering the reverse mapping. The consequence worth stating: conntrack is the state, so a full table or a restart silently kills in-flight flows, a favorite war story in networking interview questions on NAT.

Answer: Conntrack is the kernel’s flow table: the first packet of a connection creates an entry with per-protocol timeouts, and later packets match it, which is what makes stateful firewalling and NAT work. The table is capped at net.netfilter.nf_conntrack_max. When full, new packets are dropped with table full, dropping packet in dmesg while established flows keep working, so the symptom is new-connection failures under load. Check with conntrack -C against the max, raise it with the memory you have, tune timeouts, and fix the flow churn that filled it.

Answer: On every frame, the switch records the source MAC and ingress port in its CAM table, then forwards by destination: known MACs go to one port, unknown MACs flood to every port in the VLAN until learned, and entries age out. Broadcasts always flood. Two operational notes: one-way traffic plus aging causes periodic flooding microbursts, and an attacker flooding spoofed sources can turn a switch into a hub to sniff traffic, which is why port security and DHCP snooping exist.

Answer: A VLAN partitions one physical switch fabric into isolated layer 2 segments, each its own broadcast domain and subnet. 802.1Q inserts a four-byte tag carrying the VLAN ID, so one trunk link carries many VLANs between switches, while access ports serve endpoints with a single untagged VLAN. Consequence: routing between VLANs requires a router or layer 3 switch, and same-switch-different-VLAN is as separate as different buildings, the isolation model under every segmented network.

Answer: A collision domain is the set of ports whose frames can collide, which full-duplex switched Ethernet shrank to one port pair, effectively a solved problem. A broadcast domain is the set that receives each other’s broadcasts, bounded by routers and VLANs: a 48-port switch is 48 collision domains but one broadcast domain per VLAN. The practical residue: broadcast domain size still matters, because ARP storms and DHCP discovery scale with it, which is why oversized flat subnets draw criticism in networking interview questions about campus design.

Answer: An unsolicited ARP announcement: this IP now lives at this MAC. Keepalived and floating-IP systems broadcast it during failover so switches and neighbors overwrite cached bindings immediately instead of serving the dead node until caches age out, which otherwise takes minutes. When failover works for some machines and not others, cache staleness is the prime suspect, and ip neigh flush confirms it in seconds. Naming that mechanism is what this question really tests.

Answer: L4 balancing forwards on IP and port: cheap, fast, protocol-agnostic, blind to URLs, headers, and cookies, so content routing and stickiness are impossible. L7 terminates or parses the protocol, routing on paths, weighting by cookies, rewriting headers, compressing. Modern stacks combine them: L4 at the edge for raw throughput and DDoS tolerance, L7 behind it for content decisions. Expect the follow-up on why L7 must own TLS to make cookie-based choices, a staple of networking interview questions on load balancing.

Answer: Round robin for homogeneous, stateless backends; least connections when request cost varies, because it self-corrects against slow stragglers; weighted variants when capacity differs; consistent hashing for cache affinity, pinning the same key to the same backend; random with power-of-two-choices as the surprisingly strong simple option. The judgment they listen for: sticky sessions traded against horizontal scalability, and health checks deciding whether least connections keeps feeding a backend that just fell over.

Answer: Active checks probe backends on a timer with a synthetic request and pull bad nodes before users hit them, at the cost of constant background load. Passive checks judge real traffic, marking a backend down after a run of timeouts or 5xx, zero overhead but users must fail first. Production usually runs both: active for scheduled detection, passive for fast reaction between probes. Defining what makes a good check, cheap, deep enough to catch a wedged app, and exercising the real path including TLS, is the senior half of this answer.

Answer: At L4 the balancer proxies bytes so backends see its address; at L7 it terminates the connection entirely, making the proxy the socket peer. Fixes: X-Forwarded-For, appended by each trusted hop with X-Forwarded-Proto beside it; the PROXY protocol, which prefixes original addresses onto the TCP connection for L4 paths; or transparent balancing with direct server return. The security caveat: clients forge XFF headers freely, so trust only hops added by infrastructure you own, a caveat that appears constantly in networking interview questions about proxies.

Answer: VRRP lets several routers share a virtual IP owned by the highest-priority node; they exchange heartbeat multicasts, and when the master dies a backup claims the VIP and announces gratuitous ARP so the network re-points to its MAC. Keepalived packages this for Linux, and clouds expose the same shape as floating IPs or route-based failover. The detail that earns credit: failover is only as clean as the announcement, because stale neighbor caches are what keep sessions pointed at a corpse.

Answer: Equal-cost multipath forwards each flow over one of several same-cost paths, hashing the five-tuple so a conversation sticks to one path while aggregate load spreads. It is how anycast edges, leaf-spine fabrics, and bundled uplinks scale past one link without a dedicated balancer. The caveats: hashing is per flow, never per packet, because per-packet spraying reorders TCP and craters throughput, and hash imbalance plus elephant flows can still overload one member, which is why measured imbalance is the standard follow-up.

Answer: Anycast announces the same IP from many sites; BGP routes each user to the nearest or healthiest announcement, so 8.8.8.8, 1.1.1.1, and every major CDN edge are thousands of machines behind one address. Operations consequences: sessions anchor to a site, route changes can bounce them mid-connection, capacity is planned per site, and withdrawing one site’s announcement is the cleanest failover lever in networking. Comparing anycast with DNS round robins and GeoDNS rounds the answer out.

Answer: MTU is the largest payload a link carries, 1500 on standard Ethernet, less inside VPNs, tunnels, and overlays, so encapsulation shrinks the effective budget on every wrapped hop. PMTUD avoids fragmentation: senders set the don’t-fragment bit, and routers that must drop an oversized packet return ICMP fragmentation-needed with the allowed size. When a firewall drops those ICMP messages, the sender retries oversized packets forever while small requests sail through: the classic black hole, and one of the most instructive scenarios in networking interview questions.

Answer: Completed handshakes wait in the accept queue until the application calls accept(), bounded by the listen backlog and net.core.somaxconn; half-open SYNs sit in a separate SYN queue bounded by tcp_max_syn_backlog. When the app accepts slowly, a GC pause or traffic spike, the queue fills, the kernel drops or throttles new SYNs, and clients see connect timeouts and SYN retransmits while the process looks alive. Check with ss -lnt, reading Recv-Q against the backlog, then fix the accept rate.

Answer: Each probe with a fresh TTL is answered by the router that drops it, ICMP time-exceeded naming that hop. Stars mean the probe expired but the router declined to answer, common on control planes that rate-limit generated ICMP, so a starred hop can still forward traffic perfectly. Protocol matters too: default UDP probes, -I for ICMP, -T for TCP, which pierces filters that drop UDP. Reading stars as data rather than failure is the interpretation layer this question tests.

Answer: A kernel socket addressed by a filesystem path rather than an IP pair: same socket API, no network stack traversal, so lower latency, no port allocation, and access control by file permissions instead of firewall rules. Docker’s /var/run/docker.sock, PostgreSQL’s .s.PGSQL.5432, and nginx-to-PHP FastCGI over unix: are the everyday cases. Tradeoff: strictly host-local, and path collisions plus ownership mismatches replace port conflicts as the failure mode.

Answer: Two networks claiming overlapping ranges: a VPC on 10.0.0.0/16 peered with on-premises 10.0.5.0/24 makes routes for 10.0.5.x ambiguous, traffic follows whichever route wins, and one side silently breaks. Plan around it: a non-overlapping address plan before the first VPC exists, generous sizing because expansion beats renumbering, and NAT as the negotiated remedy when a collision is inherited from a merger. Saying ranges are forever, plan them like street addresses is the closing sentence this topic deserves in networking interview questions.

Answer: I narrate the layers in order, cheapest test first. DNS: does the name resolve from the affected network, dig +short, since a stale or NXDOMAIN answer explains down for some users instantly. ICMP: can they ping the IP, remembering filtered ICMP proves nothing. TCP: does the port open, nc -vz host 443, which splits refused, a service problem, from timeout, a path or firewall problem. TLS: openssl s_client for certificate and SNI failures. HTTP: curl -I for status and redirects. Each step clears a layer or hands me the failing one, and that spoken structure is exactly what scenario networking interview questions grade.

Answer: That signature is an MTU black hole, and I prove it before touching anything. Small packets fit under every path MTU; large ones carry the don’t-fragment bit, an undersized tunnel drops them, and if fragmentation-needed ICMP is filtered the sender retries silently forever. Test with ping -M do -s 1472 host, stepping the size down until replies return: that number is the path MTU. Fix by correcting the tunnel MTU, clamping MSS, or unblocking ICMP type 3 code 4 on the middleboxes. The intermittent framing, fine on some networks and hung on others, is what makes this a favorite of networking interview questions.

Answer: I capture what the server actually sends: openssl s_client -connect host:443 -servername host, and read the certificate chain section. The usual culprit is a missing intermediate: the server sends only the leaf, clients that already cached that intermediate from another site verify fine, fresh clients and containers fail. Check expiry and SAN entries while there, and test the exact failing surface, since curl, Java trust stores, and mobile webviews disagree famously. Fix by installing the full chain on the endpoint and validating from a clean client. Naming the cache-dependent intermittency is what cert-chain networking interview questions want heard.

Answer: Nothing is broken: every resolver between each user and the authority may hold the old answer until its TTL expires, and you control your record’s TTL, not the world’s caches. Confirm reality first: dig +short against the authoritative nameserver shows the new value, then against 8.8.8.8 and 1.1.1.1 shows which cached layers have caught up. Run both origins in parallel through the window, and report the TTL to stakeholders as the worst-case clock. Framing propagation as cached TTLs rather than DNS is slow is precisely the reframe DNS-flavored networking interview questions reward.

Answer: I bisect the path with mtr, which runs traceroute continuously and reports loss per hop. Loss at a hop that persists to the destination implicates that hop; loss at an intermediate hop that vanishes downstream is usually that router’s ICMP rate limiting, not real loss. Then split directions, since paths are asymmetric, and compare inside versus outside the LAN to separate wifi from the WAN. Correlate with interface counters, ip -s link and ethtool for drops and errors, and with utilization: loss at 95 percent saturation is capacity, loss at 20 percent is a bad optic or a duplex mismatch.

Answer: Identify the holder first: ss -tlnp | grep :8080 or lsof -i :8080 names the owning process. Then classify: a stale twin from a bad restart deserves a kill; a legitimate neighbor means one service must move; and if nothing shows, check other network namespaces, containers bind inside their own, and check for a crash loop grabbing the port cyclically. Name the subtle case: a fast restart failing against TIME_WAIT needs SO_REUSEADDR in the app, not a longer sleep. Every ops round includes one of these port-conflict networking interview questions, because the answer separates tool fluency from guessing.

Answer: Four candidates, in order. Bind address: ss -tlnp showing 127.0.0.1:8080 instead of 0.0.0.0 is the most common cause, the service is loopback-only by config. Host firewall: nft list ruleset or iptables -L -n -v, reading the input chain and its hit counters. Cloud security group at the perimeter, where the host is innocent. Routing and ARP: can the client reach the host’s IP at all, does a return path exist. That ordering, bind, host firewall, cloud firewall, path, resolves this pattern in minutes and narrates cleanly.

Answer: Stale ARP caches. The VIP moved to the standby, which announces gratuitous ARP, but clients or switches that missed the announcement, or whose caches age on their own schedule, keep sending frames to the dead node’s MAC until entries expire. Prove it: on a broken client, ip neigh shows the old MAC, and ip neigh flush restores service instantly. Fix properly: failover must announce aggressively, multiple gratuitous ARP with tuned switch aging, verified by a controlled failover drill. That cache-driven partial failure is the mechanism this class of networking interview questions wants explained.

Answer: CLOSE_WAIT means the peer sent its FIN, the kernel ACKed it, and the application never called close(): the connections are leaking inside the app, not the kernel. Confirm with ss -tan state close-wait | wc -l and attribute them to a process with -p. Emergency relief is restarting the leaky service; the real fix is the code path that abandons sockets without closing, typically an error branch that skips cleanup or a missing read to EOF. Each leaked socket also burns a file descriptor. This is the mirror image of the TIME_WAIT story, and contrasting the two is exactly what networking interview questions on states are testing.

Answer: Missing or wrong default route first: ip route should show a default via the gateway, and its absence after a netplan mistake or DHCP miss is the classic. Verify the gateway itself answers ping, then ip route get 8.8.8.8 to see what the kernel would actually do. If the route exists, check the return direction: the upstream router or firewall may lack a route to the new server’s subnet, since new subnets must be added on both sides. Finally NAT: an egress pool that has not learned the new range leaves outbound traffic silently blackholed.

Answer: The delta is the balancer, so I work its limits: connection and per-backend caps that queue and then drop, idle timeouts shorter than the app’s slowest endpoints, where a mid-request kill looks like a reset, and health-check flapping that yanks live backends mid-connection. Compare algorithm behavior under spike: round robin feeding a straggler versus least connections absorbing it. Read balancer-side evidence first, HAProxy logs or cloud LB reset metrics, then correlate with backend accept-queue overflows via ss -lnt Recv-Q. Limit failures at peak are the pattern this scenario round of networking interview questions probes.

Answer: Scope first: which source, port, and protocol do the checks use? Health checks originate from private balancer IPs on a specific port, while SSH came from a different source, so the new rule may allow management ranges but drop the checker. Read the counters: nft list ruleset with counters, or cloud flow logs, to see which rule the check packets actually hit. Then verify the backend listens on the check port from the balancer’s network position, nc from a like-sourced host. The lesson to state: test firewall changes with the real source address, because source-dependent rules make works from my box meaningless.

Answer: The container is not using the company resolver: public names succeed through whatever upstream it inherited, internal zones fail because only corporate resolvers know them. Check what the container actually has: cat /etc/resolv.conf inside, remembering that Docker copies the host file by default while Kubernetes injects its CoreDNS policy. Then test the path, dig internal.corp @10.0.0.53 from inside the namespace, which separates wrong resolver from resolver unreachable over the pod network. Fix by pointing the runtime at the right resolver or repairing CoreDNS forwarding. Resolver inheritance gaps are a modern staple of networking interview questions.

Answer: Ping proves IP reachability for ICMP only. Ordered causes: nothing listening, ss -tlnp on the server, which returns refused, the cleanest signal. Host firewall dropping the port, counters in nft list ruleset, which returns a timeout. Cloud security group or network ACL between them, the same timeout but invisible from the host. Service bound to the wrong interface, listening on one address while clients use another. Finally MTU oddities that pass SYNs but kill the handshake’s larger packets, visible as a connect that starts and hangs. Mapping each symptom signature to its cause is the graded skill here.

Answer: Compare paths both ways: traceroute from the office to the server, and from the server back to the office’s egress IP, ideally with mtr for stability. Different return paths through different ISPs or firewalls is the smoking gun. Asymmetry kills stateful devices: a firewall on one side only never sees the full handshake, so it drops established flows as invalid, typically after minutes of apparently working traffic. Fixes: steer both directions over one path with routing or SD-WAN policy, sync state between firewalls, or make the confused middle stateless. Naming the stateful-firewall casualty is what elevates this answer in networking interview questions.

Answer: Recognize the mechanism first: NAT collapses identity, one source IP for a thousand humans, so IP-based limiting is structurally wrong here, not mistuned. Options in preference order: authenticate and limit per user or API key, restoring identity above the network layer; limit per connection with per-IP floors high enough for NAT pools at the LB; recover real client IPs via X-Forwarded-For when a trusted CDN fronts you; and as a stopgap, carve NAT-pool exceptions while the durable fix ships. The interview point: identity must live above the IP layer in a NAT world.

Answer: Most TLS endpoints reload instead of restarting: nginx -s reload, HAProxy’s seamless reload, though Java services usually need a restart, so inventory what you actually run. Renew first with certbot or the platform mechanism, deploy the full chain including intermediates, verify with openssl s_client showing the new not-after date, then reload gracefully so in-flight connections finish on the old certificate. If the platform genuinely cannot reload, front it with a terminating proxy tonight and fix the platform tomorrow. Close with prevention: expiry alerts at 30 days and automated renewal, because this scenario in networking interview questions is really a process question.

Answer: HTTP/2 over TLS is negotiated by ALPN inside the handshake: the client offers h2 and http/1.1, the server picks. Failures mean ALPN went wrong: old libraries offering nothing, a TLS terminator stripping or misconfiguring ALPN, or a client speaking only the deprecated h2c upgrade path that browsers never shipped. Diagnose with openssl s_client -alpn h2 -connect host:443 and read the ALPN line, then test the failing client’s exact stack. The fix is usually advertising both protocols in the right order, and understanding that ALPN, not a header, does the negotiating is the point of the question.

Answer: Normal utilization with latency spikes points at queueing, not exhaustion, so I look where packets wait. Check what runs at 02:00: backups, replication, log shipping. Then measure: mtr during the spike shows which hop’s latency jumps, tc -s qdisc shows drops and backlog on the interface, and retransmit counters via nstat reveal loss-driven TCP slowdowns that bandwidth averages smooth over. Bufferbloat, a saturated uplink with huge buffers, matches this signature exactly: bandwidth looks fine while RTT multiplies. Fix by rescheduling, QoS classes for interactive traffic, or AQM like fq_codel. Correlating schedule with path is the method.

Answer: Same-VLAN success proves local link, switch, and ARP, so the break is at the routing boundary. Host config first: correct IP and mask for its subnet, and a default gateway that is the VLAN’s router interface, because a mask mismatch makes the host think remote peers are local and ARP for them forever. Then the switch side: is the port an access port on the right VLAN, or a trunk expecting tags the host does not send? Then the router: does the SVI exist for both VLANs, do ACLs permit inter-VLAN traffic, does the return route exist. Local layer 2, then the layer 3 boundary, in that order.

Answer: The tools take different paths: dig queries DNS directly and bypasses nsswitch, while curl resolves through the C library, which follows /etc/nsswitch.conf, hosts file first, then DNS per resolv.conf. A stale /etc/hosts entry shadowing DNS explains it perfectly: curl finds the old IP in hosts and never asks DNS, and curl by IP works because no resolution happens. Confirm with getent hosts name, which follows the full nsswitch chain, versus dig, which isolates DNS alone. Knowing which tool bypasses which layer is what these networking interview questions actually teach about resolution paths.

Answer: Test from the CDN’s position, not the origin’s. The likely gaps, in order: security groups or host firewall allowing your office IP but not the CDN’s published ranges; the origin LB’s listener and health configuration; TLS requirements, the CDN demanding SNI or TLS 1.2 while the origin offers something narrower; and routing or NAT for the origin’s public IP. Fetch the provider’s published IP list, probe the origin from an outside vantage, and grep firewall logs for the CDN range during a failed check. Unreachable from some vantages is the definition of a path problem, and that framing drives the investigation.

Answer: Two minutes is an idle timeout for established flows: the new kernel’s nf_conntrack_tcp_timeout_established, or a stateful middlebox, forgets the flow, the next packet arrives with no matching entry, and it is dropped or answered with RST, which apps report as resets after idle. Confirm by timing the deaths against sysctl net.netfilter.nf_conntrack_tcp_timeout_established and any middlebox timeouts. Fix at the right layer: enable TCP keepalives with an interval below the smallest timeout, or raise the device’s idle timeout. Applications assuming infinite idle connections are the real bug, and saying so rounds out the answer.

Answer: Order by invasiveness. One listener with SNI routing: nginx, HAProxy, or Traefik terminates or routes by hostname, the standard answer when both are HTTPS. If one must own TLS end to end, pass through by SNI without decryption so each service keeps its own certificates. Separate addresses: a second IP on the host, each service bound to its own, works when addressing is yours to spend. SO_REUSEPORT shares the port between processes but hands connections to whichever accepts, only sane for identical workers, which is why I would refuse it for two different services. Saying why the last option is a trap is the senior signal.

Answer: Size-dependent resets point at something enforcing a limit or a timeout the small requests never reach. Order: reverse proxy or WAF body-size limits, client_max_body_size and WAF policy, which should return a clean 413, so resets suggest a connection kill instead; LB inactivity timeouts against slow uploads, where a queue-stalled upload looks dead and gets reset; and PMTUD trouble on the upload path, which stalls rather than resets but apps surface both as resets. Reproduce with curl -T of graded sizes while capturing on both ends, find where the RST originates, then tune the enforcing layer. Attribution by RST origin is the core skill this scenario tests.

Answer: Capture with discipline: filter tightly, tcpdump -ni eth0 'host 10.0.0.5 and port 5432'; cap the bytes with -s 96 for header-only capture on fat flows; write rotating files with -C 50 -W 10 so the disk cannot fill; and use -i any only when the interface is unclear, since it doubles the work. Note the clock for correlation, capture on both endpoints when possible, and copy the pcap off-box before analysis. Even under TLS you get handshakes, retransmits, zero windows, resets, and silence, which usually ends the argument about whose layer failed. Naming what you would refuse to run, an unfiltered capture on a saturated box, is part of the answer.