Networking Interview Questions & Answers

A computer network is two or more devices connected through physical cables, wireless signals, or a combination of both to share data, resources, and services.

For interviews, go beyond the definition: mention common topologies (star, mesh, bus), the purpose of networking (resource sharing, communication, centralized management), and how networks underpin everything from a home router to cloud-scale infrastructure.

• LAN (Local Area Network) — small geographic area, high speed, privately owned
• WAN (Wide Area Network) — spans cities/countries, often leased lines or MPLS
• MAN (Metropolitan Area Network) — city-scale, connecting LANs within a metro area
• PAN (Personal Area Network) — device-to-device over very short distances (Bluetooth, NFC)
• SAN (Storage Area Network) — dedicated high-speed storage connectivity
• CAN (Campus Area Network) — interconnects multiple buildings within a campus

Interview tip: be ready to compare LAN vs WAN on latency, ownership, cost, and typical technologies in each category.

An IP address is a logical identifier assigned to a device on an IP network, enabling routing and communication. IPv4 uses 32-bit dotted-decimal (192.168.1.10); IPv6 uses 128-bit hexadecimal notation (2001:db8::1).

Cover static vs dynamic assignment, public vs private ranges (RFC 1918), loopback (127.0.0.1, ::1), APIPA (169.254.x.x), and why natural address exhaustion drove IPv6 adoption.

• IPv4: 32-bit address (~4.3 billion theoretical), NAT-dependent, broadcast, optional IPsec
• IPv6: 128-bit address (massive), no NAT needed by design, multicast replaces broadcast, IPsec mandatory, simplified header
• IPv6 features: SLAAC autoconfiguration, flow label, extension headers, and no fragmentation by routers

Explain that modern networks run dual-stack during transition; mention IPv6 adoption metrics for context.

A MAC (Media Access Control) address is a hardware identifier burned into the NIC, usually 48 bits in hex (e.g., 00:1A:2B:3C:4D:5E). The first 24 bits are the OUI (vendor), the last 24 bits are device-unique.

Differentiate from IP: MAC is link-local, IP is routable. ARP maps IP to MAC within a broadcast domain. Layer 2 switches forward on MAC; routers forward on IP.

DNS (Domain Name System) is a hierarchical distributed database that translates human-readable domain names into machine-routable IP addresses. The resolution chain typically starts at the ISP recursive resolver → root servers → TLD servers → authoritative nameserver for the domain.

Key record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (name server), TXT (SPF/DKIM text), PTR (reverse), SOA (zone metadata). Interviewers value understanding of TTL caching, zone transfers (AXFR), and DNSSEC basics.

DHCP (Dynamic Host Configuration Protocol) automates IP assignment using DORA: Discover (client broadcast), Offer (server proposes), Request (client accepts), Acknowledge (server confirms). It assigns IP, subnet mask, default gateway, DNS, and optional parameters.

Mention lease time and renewal at 50%/87.5% of lease, DHCP relay/helper for multi-subnet environments, and security considerations like rogue DHCP servers and DHCP snooping as controls.

A default gateway is the router or Layer 3 device that forwards traffic from a local subnet to destinations outside the local network. Without it, hosts can only communicate within their own broadcast domain.

Common gateway IPs: often .1 or .254 of the subnet. Misconfigured gateway is a top cause of ‘internet is down’ tickets. Redundancy via VRRP/HSRP/GLBP provides failover.

A router operates at Layer 3 (Network), forwarding packets between different networks based on destination IP addresses using a routing table built from connected, static, and dynamic routes.

Beyond definition: routing protocol families (IGP vs EGP), metrics, administrative distance, and how routers make the longest-prefix-match decision. Distinguish routers from Layer 3 switches and firewalls.

A switch operates primarily at Layer 2 (Data Link), forwarding frames within a LAN based on MAC addresses learned from source addresses. It maintains a MAC address table (CAM table) and isolates collision domains per port.

Managed vs unmanaged, VLAN support, STP, PoE, stacking, and the difference between store-and-forward, cut-through, and fragment-free switching modes.

The OSI (Open Systems Interconnection) model is a conceptual seven-layer framework that standardizes network communication functions. Each layer serves the layer above it and is served by the layer below:

<ul><li>Layer 1 — Physical: cables, connectors, bits on the wire, signal encoding</li><li>Layer 2 — Data Link: MAC addressing, frame delivery, error detection (Ethernet, PPP, switches, bridges)</li><li>Layer 3 — Network: IP addressing, routing, packet forwarding (routers, IP, ICMP)</li><li>Layer 4 — Transport: reliable/unreliable delivery, ports, segmentation (TCP, UDP)</li><li>Layer 5 — Session: dialog control and synchronization between applications</li><li>Layer 6 — Presentation: data translation, encryption, compression (TLS, ASCII, JPEG)</li><li>Layer 7 — Application: user-facing protocols (HTTP, SMTP, DNS, FTP)</li></ul><p>Interview tip: know the mnemonic ‘Please Do Not Throw Sausage Pizza Away’ and be able to classify protocols, devices, and PDUs (bits → frames → packets → segments → data) at each layer.</p>

• Physical: transmission medium, bit synchronization, topology
• Data Link: MAC addressing, frame delimiting, error detection/correction
• Network: logical addressing, path determination, packet forwarding
• Transport: end-to-end reliability, flow control, multiplexing
• Session: session establishment, maintenance, and teardown
• Presentation: data formatting, character encoding, encryption/decryption
• Application: network services to applications — HTTP, FTP, SMTP, DNS

Physical medium and Data Link protocol examples: Ethernet (IEEE 802.3), Wi-Fi (802.11), PPP. Network-layer protocols: IP, ICMP, OSPF, BGP. Transport-layer: TCP and UDP. This is a classic first-round interview staple.

Switches and bridges operate at the Data Link layer (Layer 2). They forward frames using MAC addresses, separate collision domains, and participate in STP topology. Layer 2 switches do not look at IP headers for forwarding decisions.

Modern multi-layer switches also have Layer 3 routing capabilities (MLS). Interviewers may ask why you would still use a router if a Layer 3 switch can route — answers involve WAN interfaces, advanced routing features, NAT, and firewall integration.

The IP protocol (IPv4/IPv6) is the primary Layer 3 protocol. Supporting protocols include ICMP (ping, traceroute), routing protocols (OSPF, EIGRP, BGP, RIP), and IPsec (in tunnel mode).

Be clear: ARP is not strictly Layer 3 — it bridges Layer 2 and Layer 3 by resolving IP→MAC, but it operates at the Data Link layer with Layer-3-address awareness.

Encapsulation is the process where each OSI layer adds its own header (and sometimes trailer) to the data received from the layer above as it travels down the stack from Application to Physical. Decapsulation reverses this on the receiving end, stripping headers at each corresponding layer.

PDUs by layer: Data (L5–7) → Segment (L4) → Packet (L3) → Frame (L2) → Bits (L1). Use the postal-mail analogy: letter inside envelope inside bag inside truck — each wrapper is a header.

The TCP/IP model is a four-layer practical framework: Application (combining OSI L5–L7), Transport (L4), Internet (L3), and Network Access/ Link (L1–L2). It reflects real-world protocol design more closely than the theoretical OSI model.

Compare with OSI: fewer layers, protocol-centric (named after TCP and IP), and what OSI calls ‘session’ and ‘presentation’ are typically handled within the application layer in TCP/IP (e.g., TLS sits between application and transport).

• TCP (Transmission Control Protocol): connection-oriented, reliable, ordered delivery, flow/congestion control, retransmission on loss, heavier overhead — used for HTTP(S), SSH, FTP, email
• UDP (User Datagram Protocol): connectionless, no delivery guarantee, no ordering, lightweight, low latency — used for DNS, VoIP, streaming, gaming, SNMP

Interview depth: TCP state machine (LISTEN, SYN-SENT, ESTABLISHED, FIN-WAIT, etc.), window scaling, selective ACK, and when UDP is preferred (real-time traffic where a lost packet is less impactful than a delayed retransmission).

SYN (client → server): client sends a TCP segment with SYN flag and an initial sequence number (ISN). SYN-ACK (server → client): server responds with SYN+ACK, acknowledges client ISN+1, provides its own ISN. ACK (client → server): client sends ACK acknowledging server ISN+1. Connection is now ESTABLISHED.

Bonus: know how SYN cookies defend against SYN flood DoS, and that the handshake establishes initial sequence numbers and window sizes for both directions.

Flow control prevents a fast sender from overwhelming a slow receiver. TCP uses a sliding window: the receiver advertises a receive window (rwnd) in each ACK, and the sender cannot send more unacknowledged data than the window allows.

Distinguish flow control from congestion control (which reacts to network conditions, not receiver capacity). Window scaling (RFC 7323) allows larger windows for high-BDP paths.

MTU (Maximum Transmission Unit) is the largest IP packet size (in bytes) that can be transmitted on a link without fragmentation. Ethernet default: 1500 bytes. Jumbo frames: 9000+ in data center and storage networks.

Path MTU Discovery (PMTUD) uses ICMP ‘fragmentation needed’ messages. MTU mismatch causes black-hole connectivity — packets are silently dropped. VPNs and tunnels reduce effective MTU; MSS clamping at the TCP level is a common mitigation.

• Static routing: manually configured routes, no automatic adaptation, zero protocol overhead, used for stub networks or default routes. Simple but does not scale.
• Dynamic routing: routers exchange topology information automatically using routing protocols (OSPF, EIGRP, BGP). Adapts to topology changes, adds protocol overhead and CPU/memory cost, but essential for medium-to-large networks.

Mention administrative distance: static routes usually have AD 1 (preferred over dynamic). Floating static routes use a higher AD as backup.

OSPF (Open Shortest Path First) is an open-standard, link-state IGP that uses Dijkstra’s SPF algorithm to compute the shortest loop-free path. Routers send Link-State Advertisements (LSAs) flooded within an area; all routers in the area build an identical LSDB (link-state database).

Key concepts: Areas (backbone area 0, transit, stub, NSSA), DR/BDR election on broadcast links, cost metric (reference bandwidth/link bandwidth), LSA types, and neighbor states (Down → Init → 2-Way → ExStart → Exchange → Loading → Full). OSPFv3 for IPv6.

BGP (Border Gateway Protocol) is the exterior gateway protocol that routes traffic between autonomous systems (AS) — essentially the routing protocol of the internet. It uses path-vector logic, AS_PATH attribute, and a best-path selection algorithm based on attributes (local pref, AS path length, MED, etc.).

BGP is also used internally in large enterprises and data centers (iBGP). Know the difference between eBGP (AD 20) and iBGP (AD 200), loop prevention mechanisms, and common attributes.

Administrative Distance (AD) is a numerical value (0–255) that rates the trustworthiness of a routing source. Lower AD is preferred. Common defaults: Connected 0, Static 1, eBGP 20, EIGRP (internal) 90, OSPF 110, RIP 120, iBGP 200.

When the same prefix is learned from multiple sources, AD breaks the tie before metric comparison. This prevents, for example, a RIP-learned default from overriding a static default.

A routing table is a database stored in router memory containing known network destinations (prefixes), next-hop addresses or exit interfaces, metrics, and administrative distances. The router performs a longest-prefix-match lookup for each packet to determine the next hop.

Show how to read a routing table entry: destination, mask, next-hop, interface. Explain that the default route (0.0.0.0/0) matches everything when no more specific route exists.

A VLAN (Virtual Local Area Network) logically segments a physical switch into separate broadcast domains — improving security, reducing unnecessary broadcast traffic, and enabling flexible network design without physical rewiring.

VLAN tagging: 802.1Q inserts a 4-byte tag into Ethernet frames. Native VLAN on trunk ports is untagged. Best practices: avoid VLAN 1 for user traffic, use separate management VLANs, and prune unused VLANs from trunks. Voice VLAN for IP phones is a common real-world design.

• Access port: carries traffic for a single VLAN, typically connecting end-user devices. Frames are untagged.
• Trunk port: carries multiple VLANs using 802.1Q tagging across a single physical link between switches, or between a switch and a router (router-on-a-stick).

Configuration example: switchport mode access / switchport access vlan 10 vs switchport mode trunk / switchport trunk allowed vlan 10,20,30. DTP (Dynamic Trunking Protocol) should be disabled in security-conscious environments.

Spanning Tree Protocol (IEEE 802.1D) prevents Layer 2 loops in switched networks with redundant paths by logically blocking certain ports, creating a loop-free tree topology. Without STP, broadcast storms, MAC table instability, and duplicate frames would quickly bring the network down.

Variants and improvements: RSTP (802.1w — Rapid STP, faster convergence), PVST+ (Cisco’s per-VLAN STP), MSTP (802.1s — Multiple Spanning Tree). Know root bridge election, port roles (Root, Designated, Blocking/Alternate), and port states.

• Broadcast domain: the set of devices that receive a broadcast frame (FF:FF:FF:FF:FF:FF). Routers and VLANs segment broadcast domains.
• Collision domain: the set of devices whose frames can collide on a shared medium. Switches separate collision domains per port (full-duplex eliminates collisions entirely).

Hubs = one collision domain. Switches = each port its own collision domain. Routers = each interface a separate broadcast domain. This question tests whether you understand where and why each device type fits in a design.

A Layer 3 switch combines Layer 2 switching with routing (forwarding) at Layer 3 — capable of making forwarding decisions on IP addresses and performing inter-VLAN routing without a separate router. It uses hardware-based forwarding (ASICs) for wire-speed routing.

Common use: campus distribution/core replacing router-on-a-stick. Supports static routes, OSPF, and sometimes BGP. Limitations compared to dedicated routers: fewer WAN interfaces, limited NAT, and typically no firewall features.

A firewall is a network security device (hardware or software) that monitors and controls traffic flows based on a defined rule set — typically allowing, denying, or dropping packets. It establishes the perimeter between trusted and untrusted networks.

Types: packet-filtering (stateless), stateful (tracks connection state), next-generation (application-aware with IPS/IDS, DPI, user identity). Know the implicit deny principle and best practice of least-privilege rules. Firewall placement: internet edge, between internal zones, and host-based.

• IDS (Intrusion Detection System): monitors traffic, detects suspicious patterns, and alerts — operates out-of-band. Does not block traffic.
• IPS (Intrusion Prevention System): sits inline, detects and actively blocks malicious traffic in real time. Failure modes matter — a failed IPS in fail-open may pass traffic; fail-close may cause outage.

Modern NGFWs often integrate IPS. SNORT and Suricata are popular open-source options. Detection methods: signature-based, anomaly-based, and reputation-based.

A VPN (Virtual Private Network) creates an encrypted tunnel across an untrusted network (internet), allowing remote users or branch offices to securely access private resources as if they were on the local network.

Protocols: IPsec (site-to-site and remote access with IKE), SSL/TLS VPN (clientless or thin client via browser), WireGuard (modern, lightweight, kernel-space). Concepts: tunnel encapsulation, encryption (AES-GCM), authentication (pre-shared key or certificates), and split tunneling.

NAT (Network Address Translation) maps private (RFC 1918) IP addresses to public routable IPs, primarily to conserve IPv4 address space. Types: Static NAT (1:1 mapping), Dynamic NAT (pool), and PAT/NAPT (Port Address Translation — many private IPs share one public IP via port multiplexing).

Limitations: breaks end-to-end connectivity, complicates IPsec, and some protocols embed IPs in payload (SIP, FTP) requiring ALGs. NAT is not a security feature, though it obscures internal topology as a side effect.

An Access Control List (ACL) is an ordered set of permit/deny rules applied to router or firewall interfaces to filter traffic based on source/destination IP, protocol, and ports. Standard ACLs filter by source only (1–99, 1300–1999); extended ACLs filter by source, destination, protocol, and port (100–199, 2000–2699).

Key concept: ACLs are processed top-down with an implicit deny at the end. Placement: standard ACLs as close to destination as possible; extended ACLs as close to source as possible. Named ACLs improve readability.

• Forward lookup: domain name → IP address (standard A/AAAA query)
• Reverse lookup: IP address → domain name (PTR record in the in-addr.arpa or ip6.arpa zone)

Reverse DNS is commonly used for email anti-spam validation, logging, and troubleshooting. Not all IPs have PTR records; configuring them requires cooperation from the IP address owner.

An A (Address) record maps a hostname to an IPv4 address. It is the most fundamental DNS record type. AAAA is the IPv6 equivalent. Multiple A records for the same name provide round-robin load distribution.

TTL (Time-To-Live) on A records dictates how long resolvers cache the result. Short TTLs enable fast failover but increase DNS query load.

An MX (Mail Exchange) record specifies which mail servers accept email for a domain and their priority (lower values = higher priority). SMTP delivery uses MX priority order with fallback.

Common MX issues: missing records, incorrect priorities, misconfigured A records for MX targets, and open relays. SPF, DKIM, and DMARC complement MX for email authentication and anti-spoofing.

A DHCP lease is the time-limited assignment of an IP address to a client. The client must renew at 50% of lease time (unicast to DHCP server); if that fails, it tries again at 87.5% (broadcast). When the lease expires, the address returns to the available pool.

Typical lease times: 8–24 hours for office networks, shorter for guest Wi-Fi, longer for stable servers (or use reservations). Lease management prevents address exhaustion and stale assignments.

A DHCP reservation permanently assigns a specific IP address to a device identified by its MAC address — effectively a static IP managed through DHCP. Useful for printers, cameras, and servers that need consistent addresses without manual configuration drift.

Different from static IP (manually configured on the device). Reservations centralize address management, making audit and changes easier. The device still goes through DORA but always gets the same IP.

• 802.11a (5 GHz, 54 Mbps)
• 802.11b (2.4 GHz, 11 Mbps)
• 802.11g (2.4 GHz, 54 Mbps)
• 802.11n / Wi-Fi 4 (2.4+5 GHz, up to 600 Mbps, MIMO)
• 802.11ac / Wi-Fi 5 (5 GHz, up to 6.9 Gbps, MU-MIMO)
• 802.11ax / Wi-Fi 6, 6E (2.4+5+6 GHz, up to 9.6 Gbps, OFDMA, Target Wake Time)
• 802.11be / Wi-Fi 7 (emerging, 320 MHz channels, 4K QAM, multi-link operation)

Wi-Fi 6/6E is the current sweet spot for enterprise 2026 deployments. Wi-Fi 7 is beginning to appear in premium hardware.

• WPA2: AES-CCMP encryption, 4-way handshake, vulnerable to PMKID and dictionary attacks on the handshake
• WPA3-Personal: Simultaneous Authentication of Equals (SAE/Dragonfly) resistant to offline dictionary attacks, forward secrecy
• WPA3-Enterprise: 192-bit security suite, mandatory Protected Management Frames (PMF)
• WPA3: also includes Enhanced Open (OWE) for open networks (opportunistic encryption without user interaction)

Transition mode (WPA2/WPA3 mixed) allows backward compatibility. For security assessments, capturing WPA3 handshakes requires different techniques than classic WPA2 de-auth + capture.

SSID (Service Set Identifier) is the human-readable network name broadcast in beacons and probe responses. It identifies the wireless network but is not a security mechanism — hiding the SSID (non-broadcast) does not materially improve security and can cause client connectivity issues.

BSSID is the MAC address of the access point radio, uniquely identifying the AP. ESSID is the single logical SSID across multiple APs in a multi-AP deployment.

Roaming occurs when a wireless client moves from one AP’s coverage area to another within the same ESS, maintaining network connectivity and session continuity. The client decides when to roam based on signal strength (RSSI), SNR, and vendor-specific steering algorithms.

802.11r (Fast BSS Transition) reduces re-authentication latency for voice-grade roaming. 802.11k (Radio Resource Measurement) helps clients make informed roaming decisions. 802.11v assists with network-directed roaming in controller-based deployments.

Channel interference degrades Wi-Fi performance when multiple APs or non-Wi-Fi sources (microwaves, Bluetooth, cordless phones) compete on the same or overlapping channels.

2.4 GHz: only 3 non-overlapping channels (1, 6, 11). 5 GHz: many more channels, less congestion. 6 GHz (Wi-Fi 6E): large channel pool with minimal legacy interference.

Mitigation: site survey, channel planning, band steering (prefer 5/6 GHz), dynamic channel selection, reduced transmit power, and DFS channels where regulation allows.

Use a structured methodology: 1) verify scope (one user vs whole subnet vs WAN), 2) baseline: check bandwidth utilization, packet loss, latency (ping, MTR, iPerf), 3) inspect interface errors, discards, duplex mismatches, 4) review switch/router CPU/memory and logs, 5) identify top talkers (NetFlow/sFlow) and QoS marking, 6) isolate by path segment.

Common causes: duplex mismatch, congested uplinks, faulty cables, spanning-tree topology change storms, broadcast-heavy applications, and under-provisioned WAN links. The systematic approach proves more than listing commands.

• 1. Physical: link lights on NIC and switch port? Cable properly connected?
• 2. IP configuration: ipconfig/ifconfig — does the device have a valid IP (not APIPA 169.254.x.x)?
• 3. Local gateway: can you ping the default gateway? If no, the problem is local (cable, VLAN, switch port).
• 4. DNS: can you resolve domain names (nslookup/dig)? If ping to 8.8.8.8 works but google.com fails, DNS is the culprit.
• 5. Beyond gateway: traceroute to an internet IP to find where connectivity stops.
• 6. Check firewall rules, proxy settings, and routing table.

Explaining this step-by-step in an interview demonstrates troubleshooting maturity — a systematic approach is more valuable than guessing the right tool.

An IP conflict occurs when two devices on the same broadcast domain claim the same IP address, causing one or both to lose connectivity intermittently. Detected via gratuitous ARP, system event logs, or DHCP server logs.

Resolution: identify the conflicting MAC addresses (arp -a), trace them to switch ports via MAC address table, determine which device should legitimately hold the IP, and correct the static assignment or DHCP scope. Prevention: DHCP with conflict detection, IPAM tracking, and avoiding manual static IPs in DHCP ranges.

• ping — connectivity and RTT baseline
• traceroute/tracert — path discovery and hop latency
• nslookup/dig — DNS diagnostics
• ipconfig/ifconfig — interface configuration
• netstat/ss — active connections and listening ports
• arp -a — ARP cache inspection
• nmap — port scanning and service discovery (authorized scopes)
• Wireshark/tcpdump — packet-level analysis
• MTR (My Traceroute) — continuous path monitoring with packet loss per hop
• telnet/nc — TCP port connectivity test

Interviewers want to hear that you select tools based on the symptom, not a random scattergun approach.

Packet loss occurs when data packets fail to reach their destination, typically measured as a percentage. Causes include network congestion (tail drop), faulty hardware (cable, NIC, transceiver), interface errors (CRC, runts, giants), duplex mismatch, routing loops/convergence events, QoS policing/dropping, and ISP/WAN issues.

Impact: TCP retransmits (increasing latency and cutting throughput); real-time traffic (VoIP, video conferencing) suffers quality degradation immediately. Troubleshooting: MTR shows per-hop loss; interface statistics reveal errors; Wireshark captures retransmissions and dup ACKs.

Frame a concise narrative: your networking background, key skills (routing, switching, firewalls, troubleshooting), relevant certifications, and a recent accomplishment or project. Avoid restating your resume — tell a story that connects your experience to the role.

Structure: past (foundation) → present (current role and skills) → future (why this job and where you want to grow). Keep it under two minutes and end by explicitly connecting to the position.

Express genuine interest in how connectivity works, the satisfaction of building reliable infrastructure, and the problem-solving aspect of troubleshooting. Mention specific moments that drew you in — building a home lab, a course project, or resolving an outage that affected real users.

Connect to business value: networking is the backbone of every digital service, cloud, and security control. Interviewers like candidates who see the bigger picture, not only CLI configurations.

Use STAR method (Situation, Task, Action, Result). Describe the problem clearly, your diagnostic approach, the tools and commands used, how you identified the root cause, the fix you implemented, and the measurable outcome (reduced downtime, restored service, improved performance).

Pick an example that shows methodical thinking, not luck. Even a small-scale story works if the logic is sound. Have a second example ready.

List certifications honestly. If CCNA: mention the topics you’ve covered (OSPF, VLANs, STP, ACLs, automation basics). If pursuing: share your study plan — lab hours, practice tests, target exam date.

Connect certs to practical skills: ‘My CCNA lab work included configuring OSPF across multiple areas and troubleshooting VLAN misconfigurations on real gear.’ Avoid listing a certificate you cannot discuss in detail under pressure.