In this article
Models and layers
Networking questions sit beside algorithm questions in the coding interviews path, so start with the layers. This page covers the course fundamentals and the Open Systems Interconnection (OSI) model; the networking interview questions page covers the protocol-by-protocol questions.
What are the layers of the TCP/IP model?
The model named for the Transmission Control Protocol (TCP) and the Internet Protocol (IP) has four layers: application, transport, internet and link. Request for Comments (RFC) 1122, Oct 1989 lists them this way and says its application layer combines the top two layers of the seven-layer OSI model. The User Datagram Protocol (UDP) and TCP are the two primary transport protocols; IP and the Internet Control Message Protocol (ICMP) sit in the internet layer.
Text description of the diagram
- RFC 1122 lists four layers: application, transport, internet and link.
- UDP and TCP are the two primary transport protocols; IP and ICMP sit in the internet layer.
Why it is asked: it checks that you can place any protocol in a layer before explaining it.
What is the difference between the OSI model and the TCP/IP model?
The OSI model is a seven-layer reference model; the TCP/IP model is the four-layer structure the internet's protocols were written against. The OSI layers, from the bottom, are 1 physical, 2 data link, 3 network, 4 transport, 5 session, 6 presentation and 7 application; the table shows the common mapping, though RFC 1122 says the application layer combines only presentation and application. Interviewers use the numbers as shorthand: "layer 2" means frames on the local link, "layer 3" IP packets and "layer 4" TCP or UDP.
| OSI layer | TCP/IP layer |
|---|---|
| 7 application, 6 presentation, 5 session | Application |
| 4 transport | Transport |
| 3 network | Internet |
| 2 data link, 1 physical | Link |
Why it is asked: it separates teaching vocabulary from real protocol structure.
What happens when you type a URL into a browser?
The browser reads the web address, formally a uniform resource locator (URL), asks the Domain Name System (DNS) for the server's address, opens a TCP connection to it, runs a Transport Layer Security (TLS) handshake if the address uses the secure form of the Hypertext Transfer Protocol (HTTP), sends an HTTP request and receives a response it then renders. Each step is a separate protocol on a separate layer, so you can stop at whichever layer the interviewer wants to explore. Mention caching at the browser and the DNS resolver as the reason repeat visits are faster.
Read the full explanation: networking interview questions.
Why it is asked: it is a layered tour of the whole stack in one question.
Addressing and local networks
What is the difference between IPv4 and IPv6?
IPv4 addresses are 32 bits long (RFC 791, Sep 1981); IPv6 raises the size to 128 bits and simplifies the header, and it renames the Time to Live field Hop Limit (RFC 8200, Jul 2017). In IPv6 only the source node fragments a packet, not the routers on the path. IPv4 has 4,294,967,296 addresses in total.1
Why it is asked: it tests whether you know why the address space and header changed.
What is subnetting and what does CIDR notation mean?
Classless Inter-domain Routing (CIDR) writes an address block as an address, a slash and the number of leading bits that identify the network, such as /26 (RFC 4632, Aug 2006). A /26 has 64 addresses and 62 usable hosts, because the first address names the network and the last is the broadcast address. The host 192.168.10.77/26 sits in the network 192.168.10.64 with broadcast 192.168.10.127.1
Why it is asked: it is the standard arithmetic check for networking roles.
Why did CIDR replace classful addressing?
Classful addressing offered only three block sizes, so mid-sized organisations either wasted a large Class B block or were squeezed by a small Class C block, and routing tables were growing faster than routers could manage. CIDR allows variable-length prefixes and lets providers aggregate routes (RFC 4632). The RFC says CIDR did not and does not attempt to solve exhaustion of the 32-bit address space; it eases the short- to mid-term problems of Class B exhaustion and routing-table growth.
Why it is asked: it shows you know the history behind the notation.
What are private IP addresses?
Private addresses are blocks reserved for networks that do not need global reachability: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 (RFC 1918, Feb 1996). They hold 16,777,216, 1,048,576 and 65,536 addresses respectively.1 The RFC's stated benefit is to conserve globally unique address space. Packets from these ranges need translation to reach the public internet.
Why it is asked: it leads naturally into network address translation.
What is NAT and how does it let many hosts share one address?
Network Address Translation (NAT) rewrites addresses so hosts with private addresses can reach the outside. Its port-based variation, Network Address Port Translation (NAPT), maps many private address and port pairs onto ports of one public address, so replies can be matched back to the right host (RFC 3022, Jan 2001). Sessions normally start from inside, which is why unsolicited inbound connections need extra configuration.
Why it is asked: it tests whether you understand state kept in the middle of the network.
What are the IP address and the MAC address, and why do hosts need both?
An IP address identifies a host's place in the internet and is used to route a packet across many networks; a Media Access Control (MAC) address is the hardware address on the local link. For Ethernet it is 48 bits, and a frame carries it to the next hop only (RFC 826). The IP addresses stay the same end to end, unless a NAT device on the path rewrites them, while the link-layer addresses are rewritten at every hop, which is why the Address Resolution Protocol (ARP) exists.
Why it is asked: it separates routing across networks from delivery on one link.
What are the differences between a hub, a switch and a router?
A router forwards packets between networks by examining the IP header; it generally strips the link-layer header and puts a new one on for the next hop (RFC 1812, Jun 1995). A switch works at layer 2 and forwards frames inside one network by hardware address. A hub simply repeats what it receives to every other port and is rarely used now. Say which layer each one looks at and you have answered the question.
Why it is asked: it is the standard fundamentals question for entry-level networking and computer science courses.
What is the difference between a LAN and a WAN?
A local area network (LAN) covers a small area such as a home, office or campus and is owned by one organisation. A wide area network (WAN) connects networks across cities or countries, usually over links leased from providers. The internet is a network of such networks joined by routers (RFC 1122 describes it as interconnected networks).
Why it is asked: it checks basic vocabulary before the protocol questions begin.
What is the difference between packet switching and circuit switching?
Circuit switching reserves a path for the whole conversation, as an old telephone call did. Packet switching splits data into packets that each find their own way. The Internet Protocol is the packet-switched case: it treats each datagram as an independent entity, with no connections or logical circuits, virtual or otherwise (RFC 791, Sep 1981). Packets can arrive out of order, and TCP exists to put them back.
Why it is asked: it explains why the internet needs a reliable layer above IP.
What is the difference between distance-vector and link-state routing?
In distance-vector routing each router tells its neighbours what it knows about distances; the Routing Information Protocol (RIP) is based on the Bellman-Ford distance-vector algorithm (RFC 2453, Nov 1998). In link-state routing every router holds an identical database of the whole topology and computes a shortest-path tree from it; Open Shortest Path First (OSPF) is a link-state protocol (RFC 2328, Apr 1998). Distance-vector is simpler, but RIP limits paths to 15 hops and relies on "counting to infinity" to resolve some loops, so its own standard calls it unsuited to large networks (RFC 2453 §3.2).
Why it is asked: it is the classic routing-algorithms question in networking courses.
What does ARP do?
ARP maps a protocol address to a 48-bit Ethernet hardware address. A host that lacks the mapping broadcasts a request, and the owner of the address answers directly (RFC 826, Nov 1982). That is how a host on a local network learns which hardware address to put on a frame for the next hop.
Why it is asked: it checks the link between layer 3 addresses (IP) and layer 2 frames (the local link).
How does DHCP assign an address?
The Dynamic Host Configuration Protocol (DHCP) delivers configuration from a server to a host in four messages: the client broadcasts a discover, a server offers settings, the client requests one offer, and the server acknowledges and commits the address (RFC 2131, Mar 1997). The address comes as a lease, a time-limited grant the client can renew or release.
Why it is asked: the four messages are a common whiteboard exercise.
What is ICMP and how do ping and traceroute use it?
ICMP carries feedback about problems in delivery, not reliability itself (RFC 792, Sep 1981). Ping uses the echo and echo reply messages. Traceroute works because a router that finds a packet's time to live at zero sends a Time Exceeded message back, so sending packets with rising limits reveals each hop in turn. No ICMP error is sent about another ICMP error (RFC 1122 §3.2.2, updating RFC 792), which prevents endless error chains; an echo request can still trigger Time Exceeded, which is how traceroute can use echo packets.
Why it is asked: it tests whether you can explain a tool you use daily.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Transport
What is the difference between TCP and UDP?
TCP provides a reliable, in-order byte-stream service, detecting loss with sequence numbers and errors with checksums and correcting both by retransmission (RFC 9293, Aug 2022). UDP offers a datagram service with a minimum of mechanism, and its RFC says it does not ensure delivery or protect against duplicates (RFC 768, Aug 1980). Choose by whether the application needs ordering and delivery.
Why it is asked: it is the quickest way to test whether you know what each transport provides.
How does the TCP three-way handshake work?
The three-way handshake is the exchange of three messages that opens a TCP connection and lets each side learn the other's initial sequence number: a synchronize (SYN) message from the client, a SYN and acknowledgment from the server, and an acknowledgment from the client (RFC 9293). The RFC notes that the procedure also works when two peers open at the same time. Data can follow once the third message is sent.
Why it is asked: it tests sequence numbers and state, not just the names.
How does TCP make delivery reliable?
Every byte carries a sequence number and the receiver acknowledges what it has received. The sender retransmits data that is not acknowledged, and a checksum catches corruption (RFC 9293). A sender also resends early when it sees three duplicate acknowledgments, a rule called fast retransmit (RFC 5681, Sep 2009). Reliability costs waiting, which is why latency-sensitive traffic sometimes chooses UDP.
Why it is asked: it separates naming TCP from understanding it.
What is the difference between flow control and congestion control?
Flow control protects the receiver: its advertised window says how many bytes it will accept (RFC 9293). Congestion control protects the network: the sender limits itself with a congestion window that starts small in slow start, grows about one segment per round trip in congestion avoidance and shrinks on loss (RFC 5681). The sender obeys the smaller of the two limits.
Why it is asked: candidates often merge the two ideas.
What is slow start?
Slow start is the phase at the beginning of a transfer, or after a retransmission timeout, when TCP probes capacity cautiously: the congestion window grows by at most one segment for each acknowledgment of new data, and the phase ends when the window passes a threshold or congestion appears (RFC 5681). The name is relative: the window roughly doubles every round trip, which is slow only compared with sending a whole window at once.
Why it is asked: it shows you know why new connections start slowly.
What is the time-wait state?
The side that closes a TCP connection first must linger in the time-wait state for twice the maximum segment life span, with that span set at two minutes in the specification (RFC 9293). The wait has two purposes: it makes sure the peer received the final acknowledgment of the close, and it lets delayed segments from the old connection drain so they cannot be mistaken for a new one. A busy server that closes many connections can hold many connections in this state.
Why it is asked: it appears in production-debugging stories.
When would you choose UDP?
Choose UDP when the application prefers fresh data to perfect data or supplies its own recovery: short request and response exchanges, live audio and video, games. DNS is the standard example, using UDP port 53 for ordinary queries (RFC 1035, Nov 1987). The cost is that the application must handle loss, duplication and ordering if they matter.
Why it is asked: it tests judgment about trade-offs.
DNS and the web
What is DNS and how does a lookup work?
DNS is a distributed naming system that maps names to data such as addresses. A program asks a local resolver, which retrieves the answer from name servers and follows referrals when needed; the data is split across many servers and each zone is replicated (RFC 1035). Caching at the resolver makes repeat lookups cheap, so a record's time to live matters.
Why it is asked: it is the first step of every web request.
What are the common DNS record types?
An A record holds a host's 32-bit address, a name server (NS) record names an authoritative server for a zone, a canonical name (CNAME) record gives the canonical name for an alias and a mail exchange (MX) record names a mail host with a preference value where lower is preferred (RFC 1035). A quad-A (AAAA) record holds a host's 128-bit IPv6 address (RFC 3596, Oct 2003).
Why it is asked: it checks hands-on familiarity with DNS settings.
Why does DNS use UDP, and when does it use TCP?
DNS uses UDP port 53 for standard queries because a lookup is one small question and one small answer. UDP messages are limited to 512 bytes; a longer answer is truncated and the truncation bit is set, and zone transfers do not use UDP (RFC 1035). A client that sees truncation retries over TCP (RFC 7766, Mar 2016), and the Extension Mechanisms for DNS (EDNS) let a client announce a larger UDP size (RFC 6891, Apr 2013).
Why it is asked: it ties transport choice to message size.
Why is HTTP called stateless?
HTTP is a stateless application-level request and response protocol: each request carries what the server needs and the protocol itself keeps no memory between requests (RFC 9110, Jun 2022). Applications add state with cookies or tokens that the client sends back. Statelessness is what lets any server in a pool answer any request. The page linked below covers it as a design question for representational state transfer (REST) application programming interface (API) services.
Read the full explanation: REST API interview questions.
Why it is asked: it leads into sessions, cookies and scaling.
What is the difference between GET, POST, PUT and DELETE?
Per RFC 9110 §9.3, GET retrieves a representation of the target resource; POST asks the target to process the enclosed data according to its own semantics, which is often how a new resource gets created; PUT creates or replaces the target's state with the enclosed representation; and DELETE asks the server to remove the target. The standard also calls a method safe if its semantics are essentially read-only, and idempotent if repeating the same request has the same effect on the server as sending it once (RFC 9110). GET is safe and idempotent; PUT and DELETE are idempotent but not safe; POST is neither. Idempotence is what makes an automatic retry after a dropped connection acceptable.
Read the full explanation: REST API interview questions.
Why it is asked: it tests application programming interface (API) design judgment, not memorised verbs.
What do HTTP status code classes mean?
The five classes are 1xx informational, 2xx successful, 3xx redirection, 4xx client error and 5xx server error (RFC 9110). The first digit tells a client what to do next: continue, accept, follow a redirect, fix the request or, for a 503 (temporary overload; the server may send a Retry-After header, RFC 9110 §15.6.4), wait and retry. Whether a retry is safe depends on the method being idempotent, not on the status code. Quote a few concrete codes, such as 404 and 503, to show you have used them.
Read the full explanation: REST API interview questions.
Why it is asked: it is a quick filter for backend experience.
What are the differences between HTTP/1.1, HTTP/2 and HTTP/3?
HTTP/1.x clients typically open several TCP connections to run requests concurrently, while HTTP/2 multiplexes streams on one connection with binary framing and header compression, though TCP-level blocking remains (RFC 9113, Jun 2022). HTTP/3 maps HTTP onto QUIC (a name, not an acronym, in its own standard) so that loss on one stream does not stall the others (RFC 9114, Jun 2022).
Read the full explanation: networking interview questions.
Why it is asked: it tests whether you understand head-of-line blocking.
Security and modern transport
What does TLS provide?
Transport Layer Security (TLS) 1.3 provides authentication of the server, confidentiality of data after the handshake and integrity against tampering (RFC 8446, Aug 2018). The client side can optionally authenticate too. TLS does not hide message length. A full 1.3 handshake takes one round trip before application data flows, plus an extra one if the server asks for a retry.
Why it is asked: it checks you know what the secure web protocol (HTTPS) adds.
What is the risk of TLS 0-RTT early data?
Early data, also called zero round-trip time (RTT) data, lets a client send application data in its first flight using a pre-shared key. The standard warns that this data is not forward secret and that nothing prevents the same early data from being replayed between connections, so servers must limit what early data may do (RFC 8446). Treat it as safe only for idempotent requests.
Why it is asked: it connects security to HTTP semantics.
What is QUIC and why does it exist?
QUIC is a secure transport protocol that runs over UDP and gives applications multiple independent streams, low-latency connection setup and migration of a connection to a new network path (RFC 9000, May 2021). It integrates the TLS 1.3 handshake, and it does not order bytes across different streams, which is what removes cross-stream blocking.
Why it is asked: it is the modern answer to TCP's limits.
How much does connection setup cost before the first request?
It costs round trips. TCP needs one round trip to open (RFC 9293 §3.5) and a full TLS 1.3 handshake needs one more (RFC 8446 §2), so a new HTTPS connection over TCP waits about two round trips before the request goes out. QUIC combines its transport and TLS handshakes in one exchange (RFC 9000 §7). At an illustrative round-trip time of 100 milliseconds that is 200 against 100 milliseconds before the first request byte.1
Why it is asked: it turns protocol trivia into a latency budget.
Preparing
How do you prepare for computer networks interview questions?
Practise tracing one request end to end and explain each step at its layer. Do subnet arithmetic by hand until /24 and /26 are automatic, learn the TCP states and the DNS record types, and be ready to say what breaks when each step fails. Pair this with system design practice, where these protocols become the building blocks of a design.
Why it is asked: it shows whether your preparation matches the round.
Where networks appear in interview loops
Networking questions show up in infrastructure, backend and site-reliability rounds more than in algorithm rounds, and they often arrive as a follow-up inside a design question: how does a client reach the service, what happens when a connection drops. The coding interviews hub covers the algorithm side, the interview loops guide shows where each round type fits, and the data engineering hub and the machine-learning system design hub use these protocols for pipelines and serving. At the end of a round, a good question for the interviewer is about how their services handle failure; see questions to ask the interviewer.
- Place every protocol in a layer before explaining it.
- Subnet arithmetic is mechanical: a /26 holds 64 addresses and 62 usable hosts.
- TCP gives ordered, reliable delivery at the cost of setup and waiting; UDP gives neither.
- Flow control protects the receiver, congestion control protects the network.
- DNS, HTTP and TLS each have one fact interviewers test: caching, idempotence and the handshake.
Sources
- RFC 768: User Datagram Protocol — USC/ISI (Postel), 28 Aug 1980
- RFC 791: Internet Protocol — DARPA / USC-ISI, 1 Sep 1981
- RFC 792: Internet Control Message Protocol — USC/ISI (Postel), 1 Sep 1981
- RFC 826: An Ethernet Address Resolution Protocol — RFC Editor (Plummer), 1 Nov 1982
- RFC 1035: Domain Names - Implementation and Specification — IETF (Mockapetris), 1 Nov 1987
- RFC 1122: Requirements for Internet Hosts - Communication Layers — IETF (Braden), 1 Oct 1989
- RFC 1918: Address Allocation for Private Internets — IETF, 1 Feb 1996
- RFC 1812: Requirements for IP Version 4 Routers — IETF (Baker), 1 Jun 1995
- RFC 2131: Dynamic Host Configuration Protocol — IETF (Droms), 1 Mar 1997
- RFC 2328: OSPF Version 2 — IETF (Moy), 1 Apr 1998
- RFC 2453: RIP Version 2 — IETF (Malkin), 1 Nov 1998
- RFC 3596: DNS Extensions to Support IP Version 6 — IETF, 1 Oct 2003
- RFC 3022: Traditional IP Network Address Translator — IETF (Srisuresh, Egevang), 1 Jan 2001
- RFC 4632: Classless Inter-domain Routing (CIDR) — IETF (Fuller, Li), 1 Aug 2006
- RFC 5681: TCP Congestion Control — IETF, 1 Sep 2009
- RFC 6891: Extension Mechanisms for DNS (EDNS(0)) — IETF, 1 Apr 2013
- RFC 7766: DNS Transport over TCP - Implementation Requirements — IETF, 1 Mar 2016
- RFC 8200: Internet Protocol, Version 6 (IPv6) Specification — IETF, 1 Jul 2017
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 — IETF (Rescorla), 1 Aug 2018
- RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport — IETF (Iyengar, Thomson), 1 May 2021
- RFC 9110: HTTP Semantics — IETF, 1 Jun 2022
- RFC 9113: HTTP/2 — IETF (Thomson, Benfield), 1 Jun 2022
- RFC 9114: HTTP/3 — IETF (Bishop), 1 Jun 2022
- RFC 9293: Transmission Control Protocol (TCP) — IETF (Eddy), 1 Aug 2022
