Computer Networks Interview Guide: OSI, TCP/IP, HTTP, DNS, Subnetting and Security

Why networks matter

Every web app, API and cloud service depends on networks. Interviewers use networking questions to see whether you understand what happens beneath your code. The topic is part of the standard core CS subjects alongside operating systems and databases, and it matters most for backend, DevOps and support roles.

Answer pattern: name the layer, say what problem the protocol solves, give one example.

1. Basics

A network connects devices to share data. Types by size: PAN, LAN, MAN, WAN (the internet is a network of networks). Topologies: bus, star, ring, mesh and tree. Switching: circuit switching (a dedicated path, like old phone calls) vs packet switching (data split into packets that find their own routes; used by the internet).

Key performance terms: bandwidth (capacity), throughput (actual rate), latency (delay) and jitter (variation in delay). Total delay = transmission + propagation + processing + queuing delay.

2. Layered models

OSI model (7 layers), top to bottom: Application, Presentation, Session, Transport, Network, Data Link, Physical. Memory aid: "All People Seem To Need Data Processing".

TCP/IP model (4 layers): Application, Transport, Internet, Link. This is what the internet actually uses.

Layer	Job	Examples	Data unit
Application	Services for the user	HTTP, HTTPS, DNS, SMTP, FTP, SSH	Message
Transport	Process-to-process delivery, ports	TCP, UDP	Segment / datagram
Network	Host-to-host delivery, routing	IP, ICMP	Packet
Data link	Node-to-node delivery on one link	Ethernet, Wi-Fi, MAC, ARP	Frame
Physical	Bits on a medium	Cables, signals	Bits

Encapsulation: each layer adds its own header as data moves down; the receiver removes headers on the way up. Device by layer: hub (physical, repeats to all ports), switch (data link, forwards by MAC address), router (network, forwards by IP address, connects different networks), gateway (can connect different protocols).

3. Addressing

• MAC address: 48-bit hardware address of a network card; identifies a device on the local link
• IP address: logical address of a host on a network
• Port number: identifies an application on a host (HTTP 80, HTTPS 443, SSH 22, DNS 53, SMTP 25, FTP 21)
• Socket = IP address + port
• ARP maps an IP address to a MAC address on a LAN; DHCP assigns IP addresses automatically; NAT lets many private devices share one public IP

4. IP addressing and subnetting (with worked examples)

IPv4 has 32 bits written as four decimal numbers (192.168.1.10). IPv6 has 128 bits and solves address exhaustion. Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

CIDR notation: 192.168.1.0/24 means the first 24 bits are the network part, leaving 32 - 24 = 8 host bits.

• Total addresses = 2^(host bits); usable hosts = 2^(host bits) - 2 (the network address and broadcast address are reserved)
• /24: 256 addresses, 254 usable; mask 255.255.255.0
• /26: 6 host bits, 64 addresses, 62 usable; mask 255.255.255.192

Example: split 192.168.1.0/24 into four equal subnets. Borrow 2 bits, giving /26. Subnets: 192.168.1.0/26 (hosts .1 to .62, broadcast .63), 192.168.1.64/26, 192.168.1.128/26 and 192.168.1.192/26. The block size is 64.

Example: is 192.168.1.70 in 192.168.1.0/26? That subnet covers .0 to .63, so no; it belongs to 192.168.1.64/26. Practise 10 such questions; they appear in written tests.

Know the old classes (A, B, C) for definitions, default gateway and loopback (127.0.0.1).

5. Routing and the network layer

Routers use routing tables to choose the next hop. Static routing is configured by hand; dynamic routing uses protocols (RIP distance vector, OSPF link state, BGP between internet providers). The Time To Live (TTL) field stops packets from looping forever; traceroute uses it to discover the path. ICMP carries error and diagnostic messages (ping).

6. Transport layer: TCP vs UDP

	TCP	UDP
Connection	Connection-oriented (handshake)	Connectionless
Reliability	Acknowledgements, retransmission, ordering	None built in
Control	Flow control and congestion control	None
Overhead and speed	Higher, slower	Lower, faster
Used for	Web, email, file transfer, SSH	Video and voice calls, gaming, DNS queries, streaming

Three-way handshake: client sends SYN; server replies SYN-ACK; client sends ACK; the connection is established. Closing uses FIN and ACK from each side (a four-step process).

Flow control stops a fast sender from overwhelming a slow receiver (sliding window, the receiver advertises its window size). Congestion control reacts to network overload: slow start, congestion avoidance, fast retransmit and recovery. Reliability uses sequence numbers, acknowledgements and timeouts.

Why does DNS use UDP? Small request and response, no connection setup, and the application can retry. (It switches to TCP for large responses.)

7. DNS

The Domain Name System translates names such as example.com into IP addresses. A lookup checks the browser cache, the operating system cache and then asks a recursive resolver, which queries root servers, then the TLD servers (.com), then the authoritative server for the domain. Results are cached for a TTL.

Record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (name server), TXT (text such as verification and SPF). Use nslookup or dig to look at records.

8. HTTP and HTTPS

• Request: method, URL, headers, optional body. Response: status code, headers, body.
• Methods: GET (read, safe and idempotent), POST (create, not idempotent), PUT (replace, idempotent), PATCH (partial update), DELETE (idempotent), plus HEAD and OPTIONS
• Status codes: 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirect (301 permanent, 302 temporary, 304 not modified), 4xx client error (400, 401 unauthenticated, 403 forbidden, 404, 429 too many requests), 5xx server error (500, 502, 503)
• HTTP is stateless; state is kept with cookies, sessions or tokens (such as JWT)
• Versions: HTTP/1.1 (persistent connections), HTTP/2 (multiplexing over one connection), HTTP/3 (QUIC over UDP)
• HTTPS = HTTP over TLS, giving confidentiality, integrity and server authentication

TLS handshake in outline: the client says hello and lists the ciphers it supports; the server sends its certificate (signed by a trusted certificate authority); the client verifies it; both sides agree on a shared session key using asymmetric cryptography; from then on, data is encrypted with fast symmetric encryption.

Related ideas: REST principles, CORS, caching headers, cookies (HttpOnly, Secure, SameSite), load balancers, reverse proxies and CDNs (system design basics). Know WebSockets for two-way, long-lived communication.

9. What happens when you type a URL and press Enter?

A favourite. Walk through it in order:

1. The browser parses the URL and checks its caches
2. DNS resolution turns the domain into an IP address
3. The browser opens a TCP connection (three-way handshake) to port 443
4. For HTTPS, the TLS handshake establishes encryption
5. The browser sends an HTTP request
6. The request may pass through a CDN, a load balancer and a reverse proxy to an application server, which may query a cache and a database
7. The server sends an HTTP response
8. The browser parses the HTML, requests CSS, JavaScript and images, builds the DOM, and renders the page

Add depth where you can: ARP on the local network, NAT at the router, the routing hops in between and caching at each stage.

10. Other protocols worth a sentence each

SMTP (sending mail), IMAP and POP3 (reading mail), FTP/SFTP (file transfer), SSH (secure remote shell), DHCP, SNMP (monitoring), VPN (an encrypted tunnel over the internet).

11. Network security basics

Firewalls filter traffic by rules; symmetric vs asymmetric encryption (AES vs RSA); hashing (SHA-256, for integrity, not encryption); digital signatures and certificates; common attacks: phishing, man-in-the-middle, DoS and DDoS, SQL injection, XSS, CSRF, ARP spoofing. Good habits: HTTPS everywhere, strong password hashing, least privilege, patching and input validation.

12. Tools worth knowing

ping (reachability), traceroute/tracert (path), nslookup/dig (DNS), curl -I (HTTP headers), ss or netstat (open ports), ipconfig/ip addr (addresses), tcpdump and Wireshark (packet capture), and the Network tab in browser developer tools. See Linux essentials.

Troubleshooting "the website does not load": check your own connection, then DNS (nslookup), then connectivity to the IP (ping), then the port (curl or telnet), then certificates, then server logs. Walking through such a sequence shows structured thinking.

13. Frequently asked questions

1. OSI vs TCP/IP; what does each layer do?
2. Hub vs switch vs router
3. TCP vs UDP; when would you use each?
4. Explain the three-way handshake and connection termination
5. Flow control vs congestion control
6. What is DNS? How does a lookup work? Which record types do you know?
7. What is a subnet mask? How many hosts in a /27? (32 addresses, 30 usable)
8. MAC address vs IP address; what does ARP do?
9. What is NAT? What is DHCP?
10. HTTP vs HTTPS; how does TLS work?
11. GET vs POST; what do status codes 301, 401, 403 and 502 mean?
12. Cookies vs sessions vs tokens
13. What happens when you type a URL?
14. What is a CDN? What is a load balancer?
15. How does a firewall work? What is a VPN?

14. Study tips

Draw each flow on paper (handshake, DNS lookup, the URL journey) and explain it aloud. Try the tools on a real site, and open the Network tab to see requests, headers and status codes. Practise 10 subnetting problems until they feel automatic. Add these to your final-week revision.