Computer Networks Interview Questions: 50 Questions with Clear Answers

Computer networks is the CS fundamental that interviewers use to check whether you understand what happens beneath your code. A backend engineer who cannot explain why a TCP connection takes a round trip to open, or why HTTPS needs certificates, will struggle to reason about latency, timeouts and security in real systems. This list covers the 50 questions that come up most, from campus drives to product-company fundamentals rounds, with answers sized to be spoken in under two minutes.

How Computer Networks Is Tested in Interviews

Campus and service-company interviews ask direct questions: layers of the OSI model, TCP vs UDP, classes of IP addresses. Product companies ask fewer definitions and more "explain what happens" questions, then dig: "Why is the first request to a site slower?", "What changes with HTTP/2?", "How does the browser know this certificate is real?" Networking also appears inside system design, through load balancers, CDNs, WebSockets and timeouts. Aim to explain mechanisms, not just names.

Network Models and Layers (Q1 to Q7)

Q1. Explain the OSI model.

A seven-layer reference model for network communication, each layer serving the one above:

A common mnemonic from layer 1 up: "Please Do Not Throw Sausage Pizza Away".

Q2. OSI vs TCP/IP model?

TCP/IP has four layers: link (OSI 1 and 2), internet (OSI 3), transport (OSI 4) and application (OSI 5 to 7). Some textbooks show five layers by separating physical from link. OSI is a conceptual model designed before implementation; TCP/IP grew out of working protocols and is what the internet uses. Interviewers like the observation that real protocols do not fit OSI cleanly: TLS sits between transport and application, and QUIC implements transport features in user space over UDP.

Q3. What is encapsulation?

Each layer wraps the data from the layer above with its own header (and sometimes trailer). An HTTP request becomes the payload of a TCP segment (adds ports, sequence numbers), which becomes the payload of an IP packet (adds source and destination IPs), which becomes the payload of an Ethernet frame (adds MAC addresses and a checksum trailer). The receiver strips headers in reverse, called decapsulation.

Q4. What is the difference between a MAC address, an IP address and a port?

A MAC address (48-bit, like 3c:22:fb:1a:9e:07) identifies a network interface on a local link and is used by switches. An IP address identifies a host's location in the network and is used for routing across networks; it can change when you move networks. A port (16-bit) identifies a process or service on a host: 443 for HTTPS, 22 for SSH. A connection is identified by the 5-tuple: protocol, source IP, source port, destination IP, destination port.

Q5. What are unicast, broadcast, multicast and anycast?

Unicast is one to one. Broadcast is one to all hosts on a network segment (ARP requests). Multicast is one to a subscribed group (IPTV, some trading market-data feeds). Anycast advertises the same IP from many locations and routing delivers to the nearest one; public DNS resolvers like 8.8.8.8 and 1.1.1.1 and many CDNs use anycast.

Q6. What is bandwidth vs latency vs throughput?

Bandwidth is the maximum data rate of a link (100 Mbps). Latency is the time for a bit to travel from sender to receiver, often measured as round-trip time (RTT). Throughput is the actual achieved data rate, limited by bandwidth, latency, loss and protocol behaviour. A link can have huge bandwidth and still feel slow for small requests if latency is high, because every round trip (DNS, TCP, TLS) adds delay. The bandwidth-delay product (bandwidth × RTT) is how much data must be "in flight" to fill the pipe.

Q7. What is the difference between circuit switching and packet switching?

Circuit switching reserves a dedicated path for the whole session (traditional telephone networks): predictable, but wasteful when idle. Packet switching splits data into packets that share links and are routed independently (the internet): efficient and resilient, but with variable delay and possible loss or reordering, which transport protocols must handle.

Link Layer and Network Devices (Q8 to Q12)

Q8. Hub vs switch vs router?

A hub (layer 1) repeats every incoming signal to all ports; one collision domain. A switch (layer 2) learns which MAC addresses live on which port and forwards frames only to the right port, giving each port its own collision domain. A router (layer 3) forwards packets between different IP networks using a routing table and separates broadcast domains. Your home "router" is usually a router, switch, Wi-Fi access point, NAT gateway and DHCP server in one box.

Q9. What is ARP?

Address Resolution Protocol maps an IP address to a MAC address on the local network. To send a packet to 192.168.1.10, a host broadcasts "Who has 192.168.1.10?" and the owner replies with its MAC. The answer is cached in the ARP table. For a destination outside the local subnet, the host ARPs for its default gateway's MAC, not the remote host's. ARP has no authentication, which enables ARP spoofing attacks on local networks.

Q10. What is a collision domain and a broadcast domain?

A collision domain is a segment where simultaneous transmissions collide; hubs share one, switches give each port its own, and modern full-duplex Ethernet effectively eliminates collisions. A broadcast domain is the set of devices that receive each other's broadcasts; switches forward broadcasts, routers and VLANs stop them.

Q11. What is a VLAN?

A virtual LAN partitions one physical switch network into separate logical layer-2 networks, each its own broadcast domain, using 802.1Q tags on frames. Used to separate, for example, office staff, guest Wi-Fi and servers without separate hardware. Traffic between VLANs must go through a router or layer-3 switch.

Q12. What is MTU, and what happens if a packet is too big?

The maximum transmission unit is the largest payload a link can carry in one frame: 1500 bytes for standard Ethernet. IPv4 routers can fragment oversized packets unless the Don't Fragment bit is set, in which case they drop the packet and send an ICMP "fragmentation needed" message (Path MTU Discovery). IPv6 routers never fragment; only the sender can. TCP avoids fragmentation by negotiating a maximum segment size (MSS), typically 1460 bytes over Ethernet (1500 minus 20 bytes of IPv4 header and 20 bytes of TCP header).

IP Addressing, Subnetting and Routing (Q13 to Q21)

Q13. IPv4 vs IPv6?

IPv4 addresses are 32-bit (about 4.3 billion), written as dotted decimal (203.0.113.7). IPv6 addresses are 128-bit, written in hex groups (2001:db8::1). IPv6 removes the need for NAT, has a simpler fixed header, no router fragmentation, built-in support for autoconfiguration (SLAAC), and makes IPsec part of the specification. Both coexist through dual-stack deployments. India is among the countries with the highest IPv6 adoption, largely because major mobile carriers deploy it widely.

Q14. What are private IP addresses?

Ranges reserved for internal networks and not routed on the public internet (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Your laptop at home likely has a 192.168.x.x address. Also know 127.0.0.0/8 (loopback) and 169.254.0.0/16 (link-local, self-assigned when DHCP fails).

Q15. What is CIDR and how do you subnet? Worked example.

Classless Inter-Domain Routing writes a network as address/prefix-length: 192.168.10.0/26 means the first 26 bits are the network part, leaving 6 host bits.

• Subnet mask: 26 ones = 255.255.255.192.
• Addresses per subnet: 2⁶ = 64. Usable hosts: 64 − 2 = 62 (network and broadcast addresses are reserved).
• Subnets of a /24 split into /26: 4 subnets: .0, .64, .128, .192.
• Which subnet is 192.168.10.150 in? 150 lies in 128 to 191, so network 192.168.10.128, broadcast 192.168.10.191, usable .129 to .190.

Quick trick: block size = 256 − last non-255 octet of the mask (256 − 192 = 64). Subnets start at multiples of the block size. Classful addressing (A, B, C) is mostly historical now, but campus interviews still ask the ranges: Class A 1 to 126, B 128 to 191, C 192 to 223 in the first octet.

Q16. What is NAT?

Network Address Translation lets many devices with private IPs share one public IP. The router rewrites the source IP and port of outgoing packets and keeps a translation table to map replies back. Port Address Translation (the common form) multiplexes by port. NAT conserves IPv4 addresses and hides internal hosts, but breaks end-to-end connectivity, which is why peer-to-peer apps and video calls need techniques like STUN and TURN to traverse NAT. Many Indian mobile and broadband users sit behind carrier-grade NAT, sharing a public IP with other customers.

Q17. What is DHCP? Explain DORA.

Dynamic Host Configuration Protocol assigns IP address, subnet mask, default gateway and DNS servers automatically. Four steps: Discover (client broadcasts looking for a server), Offer (server offers an address), Request (client requests that address), Acknowledge (server confirms, with a lease time). DHCP runs over UDP, ports 67 (server) and 68 (client).

Q18. What is ICMP? How do ping and traceroute work?

The Internet Control Message Protocol carries error and diagnostic messages for IP. ping sends ICMP Echo Request and measures the time to the Echo Reply. traceroute sends packets with TTL = 1, 2, 3, ...; each router that decrements TTL to zero sends back ICMP "Time Exceeded", revealing one hop at a time. Linux traceroute uses UDP probes by default; Windows tracert uses ICMP.

Q19. What is TTL in IP?

Time To Live is an 8-bit hop counter in the IPv4 header (Hop Limit in IPv6). Every router decrements it and drops the packet at zero, preventing packets from looping forever in a routing loop. Do not confuse it with DNS TTL, which is a cache lifetime in seconds.

Q20. How does routing work? Static vs dynamic, distance vector vs link state.

A router looks up the destination in its routing table using longest prefix match and forwards to the next hop. Static routes are configured by hand. Dynamic routing protocols learn routes: distance vector (RIP) shares distance tables with neighbours and uses Bellman-Ford-style updates, which can converge slowly (count-to-infinity); link state (OSPF) floods the network topology so every router runs Dijkstra's shortest path. Between organisations, BGP (a path-vector protocol) exchanges routes between autonomous systems based on policy; misconfigured BGP announcements have caused several well-known global outages.

Q21. What is a default gateway, and what is the subnet mask used for?

The subnet mask tells a host which destinations are on its local network: if (my_ip AND mask) == (dest_ip AND mask), deliver directly via ARP; otherwise send to the default gateway, the router that forwards traffic off the local network. Misconfigured masks are a classic cause of "I can reach some hosts but not others".

TCP and UDP (Q22 to Q32)

Q22. TCP vs UDP?

The interview-grade insight: UDP is not "unreliable and therefore worse". It lets applications build exactly the reliability they need. Live video prefers a dropped frame to a delayed one, and QUIC builds its own reliable streams on UDP.

Q23. Explain the TCP three-way handshake.

Each side picks a random initial sequence number (ISN) and the other acknowledges it. It costs one round trip before data can flow (the client can send data with the final ACK). Random ISNs make it hard for attackers to inject forged segments. Options like MSS, window scaling and SACK are negotiated in the SYN and SYN-ACK.

Q24. Why three messages and not two?

Both directions need their sequence number acknowledged. With two messages the server would never learn whether the client received its ISN. It also protects against old duplicate SYNs: a delayed SYN from a previous connection would make a two-way server open a connection the client never wanted; with three messages the client simply does not complete it (or resets it).

Q25. Explain TCP connection termination and TIME_WAIT.

Closing uses four segments because each direction closes independently (half-close): A sends FIN, B ACKs; later B sends FIN, A ACKs. The side that closes first enters TIME_WAIT for 2 × MSL (maximum segment lifetime; commonly about 60 seconds total on Linux) so that a lost final ACK can be retransmitted and delayed packets from the old connection do not corrupt a new one with the same 4-tuple. Servers that close many short connections can accumulate TIME_WAIT sockets, which is one reason connection pooling and keep-alive matter.

Q26. How does TCP guarantee reliability?

Sequence numbers on every byte, cumulative acknowledgements, retransmission on timeout (the retransmission timeout adapts to measured RTT), fast retransmit after three duplicate ACKs, checksums for corruption, and optional selective acknowledgements (SACK) so only missing ranges are resent. The receiver reorders out-of-order segments before delivering bytes to the application.

Q27. What is flow control? What is the sliding window?

Flow control stops a fast sender from overwhelming a slow receiver. The receiver advertises a receive window (rwnd) in every ACK: how many more bytes it can buffer. The sender keeps at most that many unacknowledged bytes in flight. As ACKs arrive, the window slides forward. If rwnd hits zero the sender pauses and sends periodic window probes.

Q28. What is congestion control? Explain slow start and AIMD.

Congestion control stops senders from overwhelming the network. The sender keeps a congestion window (cwnd); bytes in flight are limited by min(cwnd, rwnd).

• Slow start: cwnd starts small (commonly 10 segments today) and doubles every RTT, exponential growth, until it reaches the slow-start threshold or loss occurs.
• Congestion avoidance (AIMD): above the threshold, add about one segment per RTT (additive increase); on loss, cut cwnd (multiplicative decrease, typically halving with fast recovery).
• On timeout: classic Reno resets cwnd to one segment and restarts slow start.

Modern Linux defaults to CUBIC; Google's BBR models bandwidth and RTT instead of reacting only to loss. Practical consequence: a new TCP connection is slow at first, which is why connection reuse matters for performance.

Q29. Flow control vs congestion control in one line?

Flow control protects the receiver (rwnd, advertised by the receiver); congestion control protects the network (cwnd, inferred by the sender from loss and delay).

Q30. What is head-of-line blocking?

When one delayed item blocks everything behind it. In HTTP/1.1, responses on a connection must come back in order, so a slow response blocks the rest. HTTP/2 fixed that at the HTTP layer with multiplexed streams, but TCP still delivers bytes in order, so one lost packet stalls all streams until it is retransmitted: TCP head-of-line blocking. HTTP/3 over QUIC fixes this because each stream is ordered independently.

Q31. What is Nagle's algorithm, and why do people disable it?

Nagle's algorithm buffers small writes until earlier data is acknowledged, reducing tiny packets. Combined with delayed ACKs on the receiver, it can add noticeable latency to small request-response exchanges. Latency-sensitive applications (interactive terminals, games, RPC frameworks, trading systems) set TCP_NODELAY to disable it.

Q32. What is a SYN flood, and how is it mitigated?

An attacker sends many SYNs (often with spoofed source IPs) and never completes the handshake, filling the server's half-open connection queue. Mitigations: SYN cookies (encode connection state in the server's ISN so no memory is allocated until the final ACK), larger backlogs, rate limiting, and upstream DDoS protection from providers or CDNs.

DNS and HTTP (Q33 to Q42)

Q33. How does DNS resolution work?

1. Caches first. Browser cache, OS cache, and the hosts file.
2. Recursive resolver. The OS asks a configured resolver (your ISP's, 8.8.8.8, 1.1.1.1). If cached there, done.
3. Root server. The resolver asks a root server, which refers it to the TLD servers for .in or .com.
4. TLD server. Refers it to the domain's authoritative name servers.
5. Authoritative server. Returns the record (for example the A record with an IP), with a TTL.
6. Caching. The resolver and the client cache the answer for the TTL.

The resolver does the iterative walking; the client makes one recursive request. DNS uses UDP port 53 by default and falls back to TCP for large responses and zone transfers. DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt these queries.

Q34. What are the common DNS record types?

Q35. Why do DNS changes take time to "propagate"?

There is no push; resolvers worldwide cached the old record and keep using it until its TTL expires. Lowering the TTL a day before a planned migration makes the switch faster. DNS is also used for load distribution: returning different IPs per query or per region (GeoDNS), which is how many CDNs steer users to nearby servers.

Q36. What are HTTP methods? Which are idempotent and safe?

Idempotent means repeating the request has the same effect as doing it once, which matters for safe retries. Payment APIs make POST retry-safe with an idempotency key header. More in REST API interview questions.

Q37. What do HTTP status code classes mean? Name important codes.

1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. Know these: 200 OK, 201 Created, 204 No Content, 301 Moved Permanently, 302 Found, 304 Not Modified (cache revalidation), 400 Bad Request, 401 Unauthorized (actually unauthenticated), 403 Forbidden, 404 Not Found, 409 Conflict, 429 Too Many Requests (rate limiting), 500 Internal Server Error, 502 Bad Gateway (upstream returned an invalid response), 503 Service Unavailable, 504 Gateway Timeout (upstream did not respond in time).

Q38. HTTP/1.0 vs 1.1 vs 2 vs 3?

HTTP/2 server push was specified but has been removed or disabled by major browsers; mention it only as history. Connection migration matters on mobile: switching from Wi-Fi to 4G keeps a QUIC connection alive because it is identified by a connection ID, not the IP 4-tuple.

Q39. What are cookies, and how do sessions work over stateless HTTP?

HTTP is stateless. The server sets a cookie with Set-Cookie; the browser sends it back on later requests to that domain. A session cookie usually holds an opaque session ID that maps to server-side state, or a signed token such as a JWT. Important attributes: HttpOnly (no JavaScript access, mitigates XSS token theft), Secure (HTTPS only), SameSite (limits cross-site sending, mitigates CSRF), Expires/Max-Age. See OAuth2 and JWT authentication explained.

Q40. How does HTTP caching work?

Cache-Control sets policy: max-age=3600, no-cache (store but revalidate before use), no-store (never store), public/private. Validators enable cheap revalidation: the server sends an ETag or Last-Modified; the client later sends If-None-Match or If-Modified-Since; if unchanged, the server returns 304 Not Modified with no body. CDNs apply the same headers at the edge. Static assets with content hashes in their filenames can be cached for a year safely.

Q41. What is CORS?

Browsers enforce the same-origin policy: scripts on one origin (scheme + host + port) cannot read responses from another by default. Cross-Origin Resource Sharing lets the server opt in with headers like Access-Control-Allow-Origin. For non-simple requests (custom headers, methods like PUT, JSON content type), the browser first sends an OPTIONS preflight. CORS is enforced by the browser, not the server; curl ignores it. Interviewers like to hear that CORS is not a security mechanism for your API against non-browser clients.

Q42. WebSockets vs long polling vs Server-Sent Events?

Long polling holds an HTTP request open until data is available, then the client immediately re-requests. SSE keeps one HTTP response open and streams server-to-client events, with automatic reconnection. WebSockets upgrade an HTTP connection (101 Switching Protocols) into a full-duplex channel for bidirectional, low-latency messaging (chat, multiplayer, live trading dashboards). Trade-offs and scaling are covered in WebSockets vs SSE vs long polling.

TLS, HTTPS and Network Security (Q43 to Q47)

Q43. What is HTTPS, and how does the TLS handshake work?

HTTPS is HTTP over TLS, giving confidentiality (encryption), integrity (tamper detection) and authentication (you are talking to the real server). A TLS 1.3 handshake, simplified:

1. ClientHello: supported cipher suites, a random value, and a key share (an ephemeral Diffie-Hellman public key, typically X25519), plus the SNI hostname.
2. ServerHello: chosen cipher and the server's key share. Both sides now derive the same shared secret via ECDHE; everything after this is encrypted.
3. Server sends its certificate chain, a CertificateVerify signature proving it owns the certificate's private key, and Finished.
4. Client verifies the chain up to a trusted root CA, the hostname, the validity period and the signature, then sends Finished. Application data flows.

TLS 1.3 needs one round trip (TLS 1.2 needed two) and can do 0-RTT on resumption, with replay risks for non-idempotent requests. Ephemeral keys give forward secrecy: stealing the server's private key later does not decrypt past traffic.

Q44. Symmetric vs asymmetric encryption: why does TLS use both?

Asymmetric cryptography (RSA, ECDSA, ECDH) solves key exchange and authentication between strangers but is slow. Symmetric ciphers (AES-GCM, ChaCha20-Poly1305) are fast for bulk data but need a shared key. TLS uses asymmetric techniques to agree on a key and authenticate the server, then symmetric encryption for the data.

Q45. How does certificate validation work? What is a CA?

A certificate binds a public key to a domain name, signed by a Certificate Authority. Browsers and operating systems ship a set of trusted root CAs. The server presents its leaf certificate plus intermediates; the client checks each signature up to a trusted root, checks the domain matches (SAN field), the dates are valid, and the certificate is not revoked (OCSP or CRLs, with varying strictness). Let's Encrypt made free, automated certificates common.

Q46. What is a firewall, and what is the difference between stateless and stateful firewalls?

A firewall filters traffic by rules (IP, port, protocol). Stateless firewalls evaluate each packet in isolation. Stateful firewalls track connections, so return traffic for an allowed outbound connection is automatically permitted. Cloud security groups (AWS) are stateful; AWS network ACLs are stateless. Web application firewalls inspect HTTP content for attacks like SQL injection.

Q47. What is a man-in-the-middle attack, and how does HTTPS prevent it?

An attacker on the network path (rogue Wi-Fi, ARP spoofing, DNS spoofing) intercepts or alters traffic. HTTPS prevents it because the attacker cannot present a valid certificate for the domain signed by a trusted CA, so the browser warns or blocks. HSTS (Strict-Transport-Security) stops downgrade attacks by forcing browsers to use HTTPS for the domain. MITM remains possible if a user clicks through warnings or a malicious root CA is installed on the device.

What Happens When You Type a URL (Q48 to Q50)

Q48. Walk me through what happens when you type https://www.example.com in a browser.

This is the most famous networking question, because the interviewer can stop you at any step and go deep. Give the overview first, then expand where they show interest.

1. Parse the input. The browser decides whether it is a URL or a search query, applies HSTS (upgrade to HTTPS if the site is on the HSTS list), and checks its HTTP cache and service workers.
2. DNS lookup. Browser cache, OS cache, hosts file, then the recursive resolver, which may walk root, TLD and authoritative servers. Result: an IP, often of a CDN edge near you.
3. Route to the gateway. The OS sees the IP is not on the local subnet, uses ARP to find the default gateway's MAC, and sends packets there. NAT rewrites the source address at the home router.
4. TCP handshake (or QUIC for HTTP/3). One round trip.
5. TLS handshake. Cipher negotiation, key exchange, certificate verification. One round trip with TLS 1.3. ALPN negotiates HTTP/2 or HTTP/1.1.
6. HTTP request. GET / with Host, cookies, Accept headers, compression support.
7. Server side. CDN edge serves from cache or forwards to origin; a load balancer picks a backend; the application may hit caches and databases; the response returns with status, headers and HTML.
8. Browser processing. Parse HTML into the DOM, fetch CSS (CSSOM), JavaScript, images and fonts, often over the same HTTP/2 connection, with more DNS lookups for third-party domains.
9. Render. Build the render tree, layout, paint and composite. JavaScript can block parsing unless async or defer.
10. Keep alive. The connection stays open for reuse; responses are cached according to their headers.

Q49. Why is the first visit to a website slower than later visits?

The first visit pays for a DNS lookup (possibly several round trips), the TCP handshake, the TLS handshake and TCP slow start, and nothing is cached. Later visits reuse cached DNS answers, may resume TLS sessions, reuse open connections, and serve static assets from the browser cache or get 304 responses. Performance techniques target these: CDNs cut RTT, preconnect and dns-prefetch hints start handshakes early, HTTP/3 merges transport and crypto setup, and long cache lifetimes avoid repeat downloads.

Q50. Where do load balancers, reverse proxies and CDNs fit into this flow?

A CDN answers from an edge server near the user, often chosen by DNS or anycast, serving cached static content and terminating TLS close to the user. A reverse proxy (Nginx, Envoy) sits in front of servers to terminate TLS, compress, cache and route. A load balancer distributes requests across backends: layer 4 balancers route by IP and port without reading HTTP; layer 7 balancers read HTTP and can route by path, header or cookie, at more CPU cost. An API gateway adds authentication, rate limiting and routing for APIs. For a high-traffic example like live cricket streaming, see designing Hotstar's IPL live streaming.

How to Prepare Computer Networks for Interviews

1. Learn the layers with protocols attached. For each layer, name two protocols and what header fields they add.
2. Practise subnetting until you can answer "which subnet, broadcast and host range for this IP/prefix" in under a minute.
3. Use real tools. dig +trace example.com to see DNS delegation, curl -v https://example.com to see TLS and HTTP headers, traceroute to see hops, and the browser DevTools Network tab's timing breakdown (DNS, connect, SSL, waiting, download). Wireshark on your own traffic shows the TCP handshake in seconds.
4. Rehearse Q48 at three depths: a 1-minute version, a 5-minute version, and deep dives into DNS, TLS and rendering.
5. Connect to backend work. Be ready to explain timeouts, connection pooling, keep-alive, and why retries need idempotency.

Networks rounds usually come bundled with operating systems and DBMS. Continue with operating system interview questions and DBMS interview questions.

Frequently Asked Questions

Pranjal Jain

Ex-Microsoft SDE · IIT Kanpur · Founder of Prepflix. Helps engineers crack startup and product company interviews across India.