41 Networking interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
Computer networking covers how data travels between machines across layered protocols, which underpins web applications and APIs. The bank spans the OSI and TCP/IP models, routing, ARP and NAT, TLS with symmetric and asymmetric cryptography, REST versus GraphQL versus gRPC, WebSocket, SSE and long polling, plus latency, bandwidth and throughput.
The OSI (Open Systems Interconnection) model divides network communication into 7 layers, numbered from the bottom: 1. Physical: transmits bits over copper, fiber or radio. Examples: Ethernet cable, Wi-Fi radio. 2. Data Link: builds frames, uses MAC addresses and detects errors within a local network.…
The TCP/IP model (also called the DoD model) collapses the 7 OSI layers into 4: TCP/IP (4 layers) OSI (7 layers) Example protocols --------- Application Application, Presentation, Session HTTP, DNS, SSH Transport Transport TCP, UDP Internet Network IP, ICMP Network Access Data Link, Physical Ethernet,…
TCP 3-way handshake (SYN→SYN-ACK→ACK) establishes a connection by synchronizing sequence numbers on both sides. The three steps are: 1. The client sends a SYN with a random sequence number X (the ISN, initial sequence number). 2. The server replies with SYN-ACK: ACK=X+1 to confirm it…
DNS (Domain Name System) translates domain names (e.g., google.com) into IP addresses. The resolution process: 1. The browser checks its own cache. 2. It asks the OS resolver, which checks the operating system cache and the /etc/hosts file. 3. It asks a recursive resolver (the…
HTTP is request-response: the client always has to send a request first, and the server cannot push data on its own. WebSocket is a long-lived full-duplex connection: after upgrading from HTTP (the server replies 101 Switching Protocols), both sides can send messages at any time,…
REST uses HTTP verbs (GET/POST/PUT/DELETE) with URL-based resources, is stateless, easy to cache, and the most widely adopted — ideal for simple CRUD APIs, public APIs, and mobile apps. GraphQL lets clients specify exactly the data they need via a query language, solving REST's over-fetching…
Load balancing distributes requests across multiple servers — common algorithms include Round Robin, Least Connections, and IP Hash, each suited for different use cases. - Round Robin: distributes requests sequentially across servers — simple but ignores actual server load. - Weighted Round Robin: higher-capacity servers…
A forward proxy sits on the client side and acts on behalf of the client when it goes out to the internet. A reverse proxy sits on the server side and acts on behalf of the server when requests come in. A quick way to…
A CDN (Content Delivery Network) is a network of servers placed around the world; each location is a PoP (edge). DNS or anycast routes a user to the nearest PoP. If the PoP already has the file it returns it (cache hit); otherwise it fetches…
The Same-Origin Policy (SOP) is a browser rule: JavaScript on one origin (protocol + domain + port) may not read responses from another origin. CORS is how a server relaxes SOP: it returns Access-Control- headers telling the browser which origins may read the response. Before…
Rate limiting caps how many requests a client may send in a time period, so one client cannot use up the server's resources. Once over the limit the server returns 429 Too Many Requests, usually with a Retry-After header telling the client when to try…
API Key suits machine-to-machine auth, JWT enables stateless user auth, OAuth2 handles third-party authorization. The three are not at the same level: API Keys and JWTs are kinds of token/credential, while OAuth2 is a framework that defines how tokens are issued — an access token…
A WebSocket is a long-lived connection — each connected client consumes a file descriptor and memory on the server. One server can hold tens of thousands of connections, but horizontal scaling introduces a fan-out problem: client A is connected to server 1, client B is…
All three let the server deliver new data to the client right away, instead of the client asking again every few seconds. - Long polling: the client sends a normal request, and the server holds it until there is new data (or a timeout) before…
TCP teardown takes 4 steps because each direction of the connection closes independently. The side that closes first (usually called the client) starts: 1. Client sends FIN — it will send no more data. 2. Server sends ACK — acknowledges, but the server can still…
IPv4 (32-bit, ~4.3 billion addresses) has been exhausted since 2011; IPv6 (128-bit) solves this definitively, but the transition is slow because the two protocols are not backward compatible and NAT still works well enough. IPv4: 32-bit addresses (~4.3 billion) — the central pool (IANA) ran…
TLS 1.3 (2018) reworks TLS 1.2 (2008) in two directions: fewer round trips in the handshake, and dropping the old options that caused vulnerabilities. The handshake is where client and server agree on algorithms (the cipher suite), authenticate the server through its certificate and derive…
mTLS (mutual TLS) is TLS where both sides present a certificate and verify each other. Regular TLS (opening an HTTPS page) only has the client check the server's certificate. After the handshake, B knows for sure the request came from service A, not just "from…
These three pairs come up often because their names are easy to confuse. 401 vs 403 - 401 Unauthorized: the server doesn't know who you are: missing, expired or invalid token. Logging in again can fix it. The name "Unauthorized" is misleading; it really means…
An IPv4 address is 32 bits. CIDR writes an address range as 192.168.1.0/24: the number after / is the prefix, the count of leading bits fixed to identify the network; the remaining bits number the hosts. Subnetting is cutting a large range into smaller ones…
An L4 load balancer works at the transport layer: it only looks at the IP and port of a TCP/UDP connection to pick a server, without reading what is inside. An L7 load balancer works at the application layer: it receives the full HTTP request,…
These three terms measure three different things: - Latency: the time a packet takes to go from A to B, often measured as RTT (round-trip time, there and back). Most of it comes from physical distance. - Bandwidth: the maximum capacity of the link per…
Opening a new connection is expensive: the TCP handshake costs one RTT, the TLS handshake at least one more. Both HTTP Keep-Alive and connection pooling aim to open a connection once and reuse it many times, but at different layers. - HTTP Keep-Alive (persistent connection):…
An HTTP call goes through three phases, and each can hang in its own way, so each has its own timeout: - Connection timeout: the maximum time to open the TCP connection (3-way handshake). Hitting it means the server is unreachable: wrong address, a firewall…
ARP (Address Resolution Protocol) maps an IP address (layer 3) to a MAC address (layer 2) within the same LAN. When host A wants to send a packet to a destination IP on the same subnet but does not yet know its MAC, it broadcasts…
DHCP (Dynamic Host Configuration Protocol) automatically assigns an IP and network settings (subnet mask, gateway, DNS) to clients, avoiding manual static configuration. The four-step DORA process: - Discover: a new client broadcasts to find a DHCP server. - Offer: the server proposes an IP with…
NAT (Network Address Translation) rewrites private IP addresses inside a LAN into a public IP when traffic leaves for the Internet, and back again on the reply. The router keeps a NAT table mapping (private IP:port ↔ public IP:port). The problem it solves: IPv4 has…
A public IP is globally routable on the Internet, unique, and assigned by an ISP/RIR. A private IP is used only inside a LAN, is not routed on the Internet, and can be reused across different networks. The three private ranges (RFC 1918): - 10.0.0.0/8…
A MAC address is a 48-bit identifier of a network card (NIC), working at layer 2 (Data Link) and meaningful only within a single LAN. An IP address is a logical identifier at layer 3 (Network); it changes with the network you connect to and…
Two terms to know first: - Collision domain: an area where, if two devices transmit at the same time, their signals overlap (collide), so only one machine can send at any moment. - Broadcast domain: the area a broadcast packet (sent to "everyone") can reach,…
ICMP (Internet Control Message Protocol) is a layer 3 protocol used for error reporting and network diagnostics (it carries no application data), e.g. "Destination Unreachable" or "Time Exceeded". - ping sends an ICMP Echo Request to a target and waits for an Echo Reply, measuring…
Encapsulation is the process where each layer (top-down, on the sender) wraps the upper layer's data with its own header (and sometimes a trailer). In the 5-layer TCP/IP model: - Application: data - Transport: adds a TCP header → segment, or a UDP header →…
Symmetric encryption uses one shared secret key for both encryption and decryption (AES, ChaCha20). It is very fast and suits bulk data, but both sides need a safe way to obtain the same key. Asymmetric encryption uses a public/private key pair (RSA, ECC). Data encrypted…
A VPN (Virtual Private Network) creates an encrypted "tunnel" over a public network (the Internet) so a device can reach internal resources as if it were on the local network, while hiding the traffic from intermediaries. Tunneling is the underlying technique: the original packet (including…
A port is a 16-bit number (0–65535) that lets the Transport layer distinguish multiple services running on the same IP. IANA splits the range into three: well-known (0–1023, system services), registered (1024–49151), and dynamic/ephemeral (49152–65535, used by transient clients). A few common well-known ports: -…
Requests and responses share the same four-part skeleton: a first line, headers, a blank line, then a body (optional). Request — the first line is the request line: method, path, HTTP version. Response — the first line is the status line: version, status code, reason…
A DMZ (demilitarized zone) is a network segment between the internet and the internal network, reserved for servers that must accept connections from the internet. Think of a building lobby: visitors can enter the lobby, but reaching the offices requires another door. If a web…
The most reliable approach is to make the internal app listen only on 127.0.0.1 instead of 0.0.0.0. The socket then is not open on the public network interface, so there is nothing to connect to from outside. Then add a firewall as a second layer.…
