Networking
Software Engineering
Interview
Jobs
Computer Science

The Complete Computer Networking Guide for Software Engineers: Everything You Need to Crack Your Next Interview

Bharat Kalra

23 min readOct 26, 2026

A practical guide to networking fundamentals, troubleshooting commands, real-world scenarios, and interview questions for Software engineers.

1. Models and Encapsulation

Sending: each layer adds a header (encapsulation). Receiving: each layer strips its header.
TCP/IP model collapses this into Application, Transport, Internet, Link.
Interview tip: always say which layer a tool or device works at. A switch is L2, a router is L3, a classic load balancer is L4, a application load balancer at L7, a reverse proxy is L7. A firewall can be any of them but mostly work at L4 or L7.
Debugging order: L1/L2 (link up, ARP) → L3 (IP, route, ping) → L4 (port reachable) → L7 (TLS, HTTP, app).

2. Layer 2: Ethernet, ARP, Switching, VLAN

Ethernet frame: destination MAC, source MAC, EtherType, payload (up to 1500 bytes = MTU), FCS checksum.

MAC address: 48 bits, burned in to the NIC. Broadcast is ff:ff:ff:ff:ff:ff.

Switch behavior:

Learns source MACs into a MAC table (CAM table), mapped to ports.
Known destination: forwards out one port. Unknown destination or broadcast: floods out all ports in the VLAN.
Each switch port is its own collision domain. The whole VLAN is one broadcast domain.

ARP (Address Resolution Protocol):

Maps IP to MAC inside one subnet. Host broadcasts “who has 10.0.0.5?” and the owner replies with its MAC.
Results are cached (ip neigh). If the destination is outside the subnet, the host ARPs for the default gateway instead.
Gratuitous ARP: a host announces its own IP/MAC. Used in failover (VRRP/keepalived moves a virtual IP and announces the new MAC).
ARP spoofing: attacker answers with its own MAC to intercept traffic.

VLANs: split one physical switch into multiple broadcast domains. Access ports carry one VLAN untagged. Trunk ports carry many VLANs using 802.1Q tags (4 bytes, VLAN ID 1 to 4094). Traffic between VLANs needs a router (inter-VLAN routing).

Spanning Tree Protocol (STP): prevents L2 loops by blocking redundant links. Without it, broadcasts loop forever (broadcast storm). LACP/bonding combines links for bandwidth and redundancy.

3. Layer 3: IP Addressing and Subnetting

IPv4 basics

32 bits written as four octets. A subnet mask (or /N) says which bits are network and which are host.
Network address (all host bits 0) and broadcast address (all host bits 1) are not usable by hosts. Usable hosts = 2^(32−N) − 2.
Cloud providers reserve extra addresses. Azure reserves 5 per subnet (first four and last). AWS reserves 5 as well.

Worked examples

Which network is 192.168.10.77/26 in? Block size is 64. Multiples of 64: 0, 64, 128, 192. 77 falls in 64 to 127. Network 192.168.10.64, broadcast 192.168.10.127, usable .65 to .126.
Split 10.0.0.0/24 into 4 equal subnets. Need 2 extra bits → /26. Subnets: 10.0.0.0/26, .64/26, .128/26, .192/26.
Do 10.0.1.5/23 and 10.0.0.200/23 share a subnet? /23 spans two /24s: 10.0.0.0 to 10.0.1.255. Yes, same subnet.
Need 500 hosts. 2⁹ = 512 minus 2 = 510 usable → /23.

Special ranges

Private (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 (172.16 to 172.31), 192.168.0.0/16.
Loopback 127.0.0.0/8. Link-local 169.254.0.0/16 (also used by cloud metadata at 169.254.169.254). CGNAT 100.64.0.0/10. Multicast 224.0.0.0/4.
Overlapping CIDRs block peering and VPNs. Plan an IP address management scheme early.

IPv6

128 bits, hex, e.g. 2001:db8::1. Standard subnet is /64. No broadcast (uses multicast). Uses NDP (Neighbor Discovery) instead of ARP. SLAAC allows auto-configuration. Link-local fe80::/10. Dual-stack runs both IPv4 and IPv6. Common failure: a host prefers IPv6 (AAAA record) but the IPv6 path is broken, causing slow fallbacks.

ICMP

Used for control messages, not data. Echo request/reply (ping), Destination Unreachable, Time Exceeded (traceroute), and “Fragmentation Needed” (Path MTU Discovery). Blocking all ICMP is a classic cause of MTU black holes.

DHCP

DORA: Discover (broadcast), Offer, Request, Acknowledge. Gives IP, mask, gateway, DNS, lease time. Uses UDP 67 (server) and 68 (client). Clients renew at 50% of the lease. If no DHCP answer, Windows/Linux may self-assign 169.254.x.x.

4. Routing

A route table entry has destination prefix, next hop, interface, metric.
Longest prefix match: the most specific route wins. 10.1.1.0/24 beats 10.1.0.0/16 beats 0.0.0.0/0.
If prefixes tie: lower administrative distance wins (connected 0, static 1, OSPF 110, eBGP 20), then lower metric.
Default gateway is where non-local traffic goes. 0.0.0.0/0.
Each hop decrements TTL. At 0 the router drops the packet and sends ICMP Time Exceeded. That is how traceroute maps the path.
Static routing: manual, simple, no failover. Dynamic routing: protocols exchange routes.
OSPF: link-state, inside one organization, fast convergence, uses areas.
BGP: path-vector, between autonomous systems (AS), the internet’s routing protocol. Cloud links (ExpressRoute, Direct Connect, VPN) often use BGP. Chooses paths using attributes like AS-path length, local preference, MED.
Asymmetric routing: request and reply take different paths. Stateful firewalls drop the reply because they never saw the request. Very common with multiple firewalls or NVAs.
Routing loops: TTL prevents infinite looping.
Policy-based routing and user-defined routes (UDR) in clouds override defaults. Misconfigured UDRs are a leading cause of lost connectivity.
ECMP: equal-cost multipath spreads flows across several paths using a hash of the 5-tuple.

6. TCP in Depth

Header essentials

Source port, destination port, sequence number, acknowledgment number, flags (SYN, ACK, FIN, RST, PSH, URG), window size, checksum, options (MSS, window scale, SACK, timestamps).

Three-way handshake

Client sends SYN (seq=x).
Server sends SYN-ACK (seq=y, ack=x+1).
Client sends ACK (ack=y+1). Connection is ESTABLISHED. Options like MSS and window scaling are negotiated here.

Teardown

Four-way: FIN, ACK, FIN, ACK. The side that closes first goes into TIME_WAIT (about 60 s on Linux) to absorb stray packets and make sure the final ACK arrived. RST abruptly aborts a connection.

Reliability and flow control

Every byte has a sequence number. ACKs confirm receipt. Lost data is retransmitted after a timeout (RTO) or after 3 duplicate ACKs (fast retransmit).
Flow control: receiver advertises a window (rwnd) so the sender does not overwhelm it. A zero window means the receiver is saturated.
Congestion control: sender maintains a congestion window (cwnd). Slow start grows it exponentially, then congestion avoidance grows it linearly. On loss, cwnd shrinks. Algorithms: Reno, CUBIC (Linux default), BBR (model-based, good on lossy or high-latency links).
Throughput limit: about window / RTT. Bandwidth-delay product (BDP) = bandwidth × RTT is the window needed to fill a link. High-latency links need window scaling.
Delayed ACK and Nagle’s algorithm can add up to about 40 ms latency for small writes. TCP_NODELAY disables Nagle.
TCP keepalive: probes idle connections to detect dead peers. Default Linux idle is 2 hours, far longer than most NAT/load balancer idle timeouts (often 4 to 5 min on clouds). Tune it when long-idle connections get silently dropped.
SYN cookies protect against SYN floods. Backlog queues (somaxconn, tcp_max_syn_backlog) limit pending connections.

RST vs timeout (very common interview point)

Connection refused (RST): host is reachable, nothing listening on that port (or something actively rejects).
Timeout (no response): packets are silently dropped (firewall DROP, wrong route, host down) or the return path is broken.
Connection reset mid-stream: a peer or middlebox killed it (idle timeout, crashed process, proxy limit).

7. UDP and QUIC

UDP: connectionless, no ordering, no retransmission, 8-byte header. Application handles reliability.
Used for DNS, DHCP, NTP, syslog, VoIP, video, and games.
Packet loss means lost data, not retransmission delay (good for real time).
QUIC (HTTP/3): runs over UDP, built-in TLS 1.3, multiplexed streams without head-of-line blocking at the transport layer, faster connection setup (0-RTT/1-RTT), and connection migration across networks.
Many corporate firewalls block UDP/443, so clients fall back to HTTP/2 over TCP.

8. DNS in Depth

Record types

A (IPv4), AAAA (IPv6), CNAME (alias to another name, cannot coexist with other records at the same name, so not allowed at the zone apex), MX (mail), TXT (SPF, verification), NS (delegation), SOA (zone authority, serial, timers), SRV (service location with port), PTR (reverse lookup), CAA (which CAs may issue certs).

Resolution flow

App checks its own cache, then the OS stub resolver (/etc/hosts first, per nsswitch.conf).
Stub asks the recursive resolver (from /etc/resolv.conf, DHCP, or the cloud).
The recursive resolver, if uncached, asks a root server → gets TLD servers (.com) → gets the authoritative server → gets the answer, then caches it for the TTL.

Recursive = does the work for you. Authoritative = holds the actual records.
Iterative queries are what the recursive resolver sends to the hierarchy.

Behaviors to know

TTL: cache lifetime. Lower it before migrations (at least one old-TTL period ahead).
Negative caching: NXDOMAIN is cached based on the SOA minimum.
Round-robin DNS: multiple A records, clients pick one. No health awareness.
GeoDNS / latency-based / weighted routing: used by Route 53, Azure Traffic Manager.
Split-horizon (split-brain) DNS: different answers inside vs outside.
Transport: UDP/53 by default. TCP/53 for responses over the UDP limit (EDNS0 allows about 1232 to 4096 bytes), zone transfers (AXFR), and DNS over TCP fallback. Also DoT (853) and DoH (443).
DNSSEC: signs records so resolvers can verify authenticity.
Search domains and ndots in resolv.conf: a name with fewer dots than ndots is tried with each search suffix first, multiplying lookups.
Common failures: wrong resolver, firewall blocking 53, stale cache, CNAME at apex, missing PTR, lame delegation, and clients that cache forever (JVM networkaddress.cache.ttl, long-lived processes).

dig cheat sheet

dig example.com (default A)
dig @8.8.8.8 example.com (specific resolver)
dig +trace example.com (walk root → TLD → authoritative)
dig +short example.com MX
dig -x 1.2.3.4 (reverse)
Read the status: (NOERROR, NXDOMAIN, SERVFAIL, REFUSED), the answer TTL (counts down if cached), and the Query time.

9. HTTP in Depth

Request: method, path, version, headers, optional body. Response: status, headers, body.
Methods: GET (safe, idempotent), POST (not idempotent), PUT (idempotent replace), PATCH, DELETE (idempotent), HEAD, OPTIONS (CORS preflight).
Status codes: 200 OK, 201 Created, 204 No Content, 301 permanent redirect, 302/307 temporary redirect, 304 Not Modified, 400 Bad Request, 401 Unauthenticated, 403 Forbidden, 404 Not Found, 408 Request Timeout, 429 Too Many Requests, 500 Internal Error, 502 Bad Gateway (invalid upstream response or connection failure), 503 Service Unavailable, 504 Gateway Timeout (upstream too slow).
Versions:
HTTP/1.1: persistent connections (keep-alive), one outstanding request per connection, so browsers open several. Head-of-line blocking.
HTTP/2: binary, multiplexed streams over a single TCP connection, header compression (HPACK). TCP-level head-of-line blocking remains.
HTTP/3: over QUIC, removes that blocking.
Important headers: Host (virtual hosting), Content-Length / Transfer-Encoding: chunked, Connection: keep-alive, Cache-Control, ETag, Authorization, X-Forwarded-For, X-Forwarded-Proto, Upgrade (WebSocket).
Cookies and sessions: stateless HTTP, state kept via cookies or tokens.
CORS: a browser-enforced policy, not a network control.
Keep-alive and idle timeouts: if the server’s idle timeout is shorter than the client’s or proxy’s, the proxy may reuse a connection the server just closed, producing random 502s. Rule: the upstream idle timeout should be longer than the downstream one.

10. TLS in Depth

Provides confidentiality, integrity, and server authentication.
TLS 1.3 handshake (1 round trip): ClientHello (supported ciphers, key share, SNI) → ServerHello + certificate + key share + Finished → client Finished → encrypted data. TLS 1.2 needs 2 round trips.
SNI (Server Name Indication): the client states the hostname in the ClientHello so one IP can serve many certificates. Missing SNI often returns the wrong or default cert.
Certificate chain: leaf → intermediate(s) → root. The server must send leaf + intermediates. Clients hold roots in a trust store.
Validation checks: chain trusted, not expired, hostname matches CN/SAN, not revoked (CRL/OCSP), valid usage.
Key exchange: ephemeral (ECDHE) gives forward secrecy: past traffic stays safe even if the private key leaks later.
mTLS: server also requests and validates a client certificate. Used for service-to-service authentication.
Termination vs passthrough vs re-encryption: terminate at the proxy (proxy sees plaintext, can do L7 routing), pass through (proxy only sees TCP, no L7 features), or terminate and re-encrypt to the backend.
ALPN: negotiates the application protocol (h2 vs http/1.1) during the handshake.
Certificate lifecycle: automate renewal (ACME / Let’s Encrypt, 90-day certs). Expiry outages are among the most common incidents. Monitor days-to-expiry.
Debug:
openssl s_client -connect host:443 -servername host -showcerts
openssl x509 -noout -dates -subject -issuer -ext subjectAltName
curl -vI https://host
Common errors: certificate has expired, hostname mismatch, unable to get local issuer certificate (missing intermediate or untrusted root), handshake failure (no common protocol or cipher), unknown ca (peer does not trust the issuer).

11. NAT

SNAT (source NAT): rewrites source IP for outbound traffic. DNAT (destination NAT): rewrites the destination for inbound (port forwarding, load balancing). PAT / NAPT: many hosts share one public IP, distinguished by translated source ports. A NAT table tracks each flow (the conntrack table on Linux).
Limits: about 64K ports per public IP per destination IP/port/protocol. Heavy outbound traffic needs more public IPs. Cloud NAT Gateways document their per-IP port capacity.
Idle timeouts: NAT entries expire (cloud defaults of about 4 to 10 minutes for TCP). After that, the next packet gets a RST or is dropped. Use keepalives shorter than the timeout.
Conntrack table full: Linux logs nf_conntrack: table full, dropping packet. Raise nf_conntrack_max, reduce timeouts, or avoid NAT on busy paths.
Side effects: hides client IPs, breaks end-to-end addressing, complicates protocols that embed IPs (old FTP, SIP).
Hairpin NAT: an internal client reaches an internal server via the public IP. Needs special handling.
Static public egress IP: needed for partner allow-listing. Use a NAT gateway or egress proxy.

12. Load Balancing

L4 (transport): decides by IP and port, forwards TCP/UDP flows, no payload inspection, very fast, preserves protocols. Examples: Azure Load Balancer, AWS NLB, LVS/IPVS.
L7 (application): terminates HTTP, routes by host, path, header, cookie. Can do TLS termination, redirects, rewrites, WAF, retries. Examples: NGINX, HAProxy, Envoy, AWS ALB, Azure Application Gateway.
Algorithms: round robin, weighted round robin, least connections, least response time, IP hash/consistent hash (for cache affinity).
Health checks: TCP connect, HTTP path with expected status. Tune interval, timeout, and unhealthy threshold. Shallow checks (process up) vs deep checks (dependencies up). Deep checks that fail on a shared dependency can take the entire pool down.
Connection draining (deregistration delay): stops new connections to a backend, lets existing ones finish.
Session persistence: by source IP or cookie. Prefer stateless apps.
Direct Server Return (DSR): replies skip the load balancer. The backend must own the VIP.
Client IP preservation: at L4 either the source IP is kept (DSR/transparent) or lost (SNAT). Use PROXY protocol or X-Forwarded-For at L7.
High availability of the LB itself: active/passive with VRRP, or anycast and ECMP across multiple LBs.
Global load balancing: DNS-based or anycast, routing users to the nearest healthy region.
Pitfalls: long-lived HTTP/2 or gRPC connections pin to one backend under L4. Uneven distribution from few clients with sticky hashing. Retries without idempotency cause duplicate writes. Timeouts that don’t match across layers.

13. Firewalls and Access Control

Stateless (ACL, e.g. AWS NACL): judges every packet alone, so return traffic needs an explicit rule (including ephemeral port ranges).
Stateful (security groups, NSGs, iptables with conntrack): tracks connections. Allow inbound 443 and the reply is automatically allowed.
Next-gen firewall / WAF: inspects L7, TLS, signatures, bot patterns, SQL injection, and so on.
Rule evaluation: by priority (lowest number first in Azure NSG, first match wins) or top-down. An explicit deny beats the implicit default.
DROP vs REJECT: DROP gives a timeout. REJECT gives an immediate refusal (RST or ICMP unreachable). That is why a timeout hints at a firewall.
Layers to check when blocked: local app binding, OS firewall, cloud security group/NSG at NIC and subnet, network ACL, routing, intermediate firewall/NVA, and the destination’s own controls.
Linux: iptables/nftables with tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING). Use iptables -L -n -v --line-numbers and watch the packet counters.
Bastion/jump hosts, zero trust, micro-segmentation, egress filtering are standard security patterns.
DDoS: SYN floods, UDP amplification (DNS, NTP), L7 floods. Defenses: rate limiting, SYN cookies, scrubbing, anycast absorption, WAF.

14. Proxies and Reverse Proxies

Forward proxy: represents clients to the internet (corporate filtering, caching, egress control). Clients use CONNECT for HTTPS tunneling.
Reverse proxy: represents servers to clients (NGINX, HAProxy, Envoy). Handles TLS, routing, caching, compression, rate limiting, auth.
Transparent proxy: intercepts traffic without client configuration.
Headers: X-Forwarded-For appends each hop's client IP (the leftmost is the original client, but only trust entries added by your own proxies). Forwarded is the standard form. X-Real-IP is common in NGINX.
PROXY protocol (v1/v2): prepends a small header with the original client info to a TCP connection, for L4 passthrough.
Timeouts to align: client → LB idle, LB → backend connect/read, backend keep-alive. Mismatches create sporadic 502/504.
WebSockets: require Upgrade and Connection headers and long idle timeouts.
Buffering: request/response buffering affects streaming, large uploads, and server-sent events. Disable it where needed.
Retries and circuit breaking: retry only idempotent requests, with backoff and a retry budget, or you amplify outages (retry storms).

15. VPN and Private Connectivity

IPsec: IKE negotiates (UDP 500, 4500 for NAT-T), ESP carries encrypted data. Site-to-site connects networks. Policy-based vs route-based tunnels. Mismatched phase 1/2 parameters (encryption, DH group, lifetime, traffic selectors) are the top cause of tunnels that will not come up.
WireGuard / OpenVPN: remote-access VPNs. WireGuard is simple, fast, UDP-based.
Split tunnel vs full tunnel: whether only corporate ranges or all traffic enter the VPN.
Dedicated circuits: ExpressRoute, Direct Connect. Private, predictable latency, usually with BGP.
Peering: VPC/VNet peering is non-transitive. Use a hub (transit gateway, virtual WAN) for many-to-many.
Hub-and-spoke: shared services and firewall in the hub, workloads in spokes. Needs UDRs to force traffic through the hub firewall.
Private endpoints / Private Link: gives a managed service a private IP in your network. Requires private DNS so the service name resolves to that private IP.
Common issues: overlapping CIDRs, missing return routes, asymmetric paths, MTU, DNS not resolving the private name, and NSGs blocking on one side only.

16. Performance Concepts

Latency (time), bandwidth (capacity), throughput (achieved rate), jitter (latency variation), packet loss.
RTT(Round-Trip Time) drives TCP and TLS setup costs. A new HTTPS connection costs roughly 1 RTT for TCP + 1 RTT for TLS 1.3 (2 for TLS 1.2). Connection reuse removes this.
Throughput on a single TCP flow is limited by window / RTT and by loss. Even small loss hurts badly over high RTT.
Bufferbloat: oversized buffers cause latency under load.
Head-of-line blocking: one lost packet stalls ordered data behind it.
Tuning knobs: connection pooling, keep-alive, HTTP/2, compression, CDN, TCP buffer sizes, somaxconn, congestion control (BBR), and putting services closer to users.
Measurement: iperf3 (throughput), mtr (loss and latency per hop), curl -w timing variables (time_namelookup, time_connect, time_appconnect, time_starttransfer, time_total).

17. Troubleshooting Toolkit

Reading tcpdump quickly:

Only SYN repeated, no SYN-ACK → drop on the path or the server is not receiving.
SYN then RST → nothing listening or active reject.
SYN, SYN-ACK, ACK, then stall → look at MTU, application, or an idle timeout.
Many retransmissions → loss or congestion.
Useful flags: -n (no name resolution), -i, -w file.pcap to open in Wireshark, 'tcp[tcpflags] & tcp-syn != 0' to filter SYNs.

General method: define the failing source, destination, port, and protocol exactly. Reproduce. Check name → route → port → firewalls → TLS → app. Compare a working client with a failing one. Change one variable at a time. Capture packets at both ends if needed.

Scenario Questions

Try answering each one aloud before reading the answer. Answers follow below.

A server pings a service IP fine, but curl times out. What do you check?
Connecting to a port gives “Connection refused” in one environment and a timeout in another. What does each mean?
Two networks that both use 10.0.0.0/16 must be connected.
A VM subnet is a /28. How many VMs can you place in a cloud?
A host has thousands of TIME_WAIT sockets and outbound calls start failing.
A service has thousands of CLOSE_WAIT sockets.
After a DNS change, some users still hit the old IP.
Intermittent 5-second delays on name lookups from Linux hosts.
Browser works, but curl reports "unable to get local issuer certificate".
A certificate is valid but clients report a hostname mismatch only on one IP.
Small requests work, large uploads hang across a VPN.
A VM loses internet access after attaching a route table with 0.0.0.0/0 to a firewall.
A partner will only whitelist one source IP, but you have many servers.
Users see 502 errors for a few seconds after each deployment.
A gRPC client sends nearly all traffic to one backend behind an L4 load balancer.
Inbound 443 is allowed in the firewall rule but connections still time out.
The app logs show every client as the proxy’s IP.
A private endpoint name resolves to a public IP.
Random 504 errors on requests that take about 60 seconds.
A long-idle database connection fails on the first query after a quiet period.
Page loads feel slow. How do you find out whether it is network, TLS, or the app?
Packet loss shows at one middle hop in mtr but not at the destination.
Two servers in the same subnet cannot reach each other, but both reach the gateway.
Everything breaks briefly each time a failover happens between two firewalls.
Walk through what happens when you type https://example.com and press Enter.
“Service A cannot talk to Service B.” Walk through your approach.

Answers

1. Ping works, curl times out. Ping proves L3 reachability only. Test the port with nc -zv ip 443. If it times out, a firewall, security group, or ACL is dropping it, or a route problem affects only that flow. On the server, check ss -tulpn that it listens on the right address (not just 127.0.0.1), then tcpdump to see whether SYNs arrive. If the port is open, run curl -v and look at TLS and HTTP.

Get Bharat Kalra’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

2. Refused vs timeout. Refused means a RST came back: the host is reachable but nothing listens on that port (or a device rejects deliberately). A timeout means silence: packets are dropped by a firewall, routed wrongly, or the host is down. So in the second environment, suspect firewall or routing. In the first, suspect the service not running or bound elsewhere.

3. Overlapping CIDRs. Direct peering or routing cannot work because the destination is ambiguous. Options: re-IP one side (clean but disruptive), put NAT between them (translate one range to a unique one, but this complicates logs and apps), or expose just the needed services through private endpoints, a proxy, or an API gateway. Prevent it going forward with a central IP address plan.

4. /28 in the cloud. A /28 has 16 addresses. With 5 reserved by the cloud, 11 are usable. Subnets also cannot be shrunk once in use, so size for growth and for services that take several IPs (load balancers, gateways).

5. Many TIME_WAIT. TIME_WAIT is normal for the side that closes first, but many mean lots of short-lived connections. With a limited ephemeral port range (about 28K ports per destination) or limited NAT ports, new connections fail. Fix the cause: enable keep-alive, use connection pooling, and use HTTP/2. Mitigate by widening ip_local_port_range and adding NAT IPs. tcp_tw_reuse can help for outbound connections but does not replace reuse.

6. Many CLOSE_WAIT. The remote side closed, but the local app never called close(). It is an application bug or a leak (missing close in error paths, a thread stuck, a pool not releasing). The kernel cannot fix it. Find the process with ss -tanp state close-wait, then inspect the code or connection handling. Restarting only hides it.

7. Old IP after DNS change. Caches hold the old answer until TTL expires: recursive resolvers, OS caches, browsers, and application caches (JVM or long-lived processes). Check with dig @resolver for several resolvers and the authoritative server directly. Plan changes by lowering the TTL ahead of time (at least the old TTL before the change), then raise it after. Remember some resolvers ignore low TTLs.

8. 5-second DNS delays. 5 seconds is the default resolver timeout before retrying. Likely causes: an unreachable or slow first nameserver in resolv.conf, dropped UDP DNS packets (packet loss, conntrack race on parallel A and AAAA queries from the same socket), or IPv6/AAAA lookups failing. Test with dig against each resolver and watch tcpdump port 53. Fixes: remove dead resolvers, add local caching (systemd-resolved, dnsmasq), options single-request-reopen or use-vc, and reduce search domain and ndots overhead.

9. Missing intermediate. The server sends only the leaf. Browsers can fetch missing intermediates (AIA) or cache them, but curl and many libraries cannot. Confirm with openssl s_client -showcerts (chain shows only one cert). Fix the server to send the full chain (leaf + intermediates, not the root).

10. Hostname mismatch on one IP. That IP serves a different default certificate, either because SNI is missing in the client (old client, connecting by IP) or one backend or LB node has a different certificate configured. Test with openssl s_client -connect ip:443 -servername name and compare per node. Fix by aligning certificates across all nodes and making clients send SNI.

11. VPN MTU black hole. Handshakes and small packets pass, but full-size packets exceed the tunnel MTU, and ICMP “fragmentation needed” is blocked or DF is set, so PMTUD fails. Confirm with ping -M do -s 1400 host and vary the size. Fix by lowering the interface MTU, clamping TCP MSS on the tunnel endpoint, and permitting ICMP type 3 code 4.

12. Lost internet after UDR to firewall. Traffic now depends on the firewall. Check: does it have a rule to allow the flow, does it SNAT outbound traffic to a public IP, does it have a route back to the VM subnet, and could the return path be asymmetric so the stateful device drops replies. Verify with the firewall logs and traceroute from the VM. Also confirm IP forwarding is enabled on a Linux or NVA appliance.

13. Single source IP for a partner. Send all outbound traffic through a NAT gateway or egress proxy with a static public IP and give that IP to the partner. Size it for the number of concurrent connections (about 64K ports per public IP per destination), and add more IPs if needed, telling the partner about all of them.

14. 502s after deployments. Instances are removed or killed while still serving, or new ones are added before they are ready. Fixes: readiness health checks that reflect real readiness, connection draining on the load balancer, and graceful shutdown (handle SIGTERM: stop accepting, finish in-flight work, then exit). Wait a few seconds after deregistration before stopping the process, since load balancer updates are not instant. Also check keep-alive mismatch: the backend’s idle timeout must exceed the proxy’s.

15. gRPC and L4 balancing. gRPC uses HTTP/2, which multiplexes many requests over one long-lived TCP connection. An L4 balancer balances connections, not requests, so one connection means one backend. Use an L7 balancer that balances per request, client-side load balancing, or set a maximum connection age so clients reconnect periodically.

16. 443 allowed but times out. Check every layer: service listening on the right interface and port, OS firewall, security group at NIC and subnet, NACL (stateless needs return ephemeral ports), route and return path, and any intermediate firewall. Use tcpdump on the server: if SYNs never arrive, the block is upstream. If SYN-ACKs leave but the client never gets them, the return path is blocked or asymmetric.

17. All clients show the proxy’s IP. The proxy or L4 balancer SNATs the connection, so the app sees the proxy’s address. Pass the original through X-Forwarded-For (L7) or PROXY protocol (L4), and configure the app to trust those headers only from known proxy IPs, otherwise clients can forge them. Take the right-most untrusted entry, not blindly the leftmost.

18. Private endpoint resolves public. The private DNS zone is missing, not linked to the VNet, or the custom DNS server does not forward that zone to the cloud resolver. Check with dig from the affected host and see which resolver answered. Fix by linking the zone to the VNet or adding a conditional forwarder to the cloud's resolver, and make sure on-premises DNS forwards to it too.

19. 504 at about 60 seconds. A timeout mismatch: some layer (load balancer, proxy, or gateway) has a 60-second idle or read timeout, and the backend takes longer. Find the layer by checking which component generated the 504 (response headers or logs). Raise timeouts consistently with outer layers longer than inner ones, or restructure long work as asynchronous jobs with polling or callbacks.

20. First query fails after idle. A middlebox (NAT, load balancer, firewall) dropped the idle connection state after its idle timeout, but both ends still think it is open. The next packet gets a RST or is dropped. Fix with TCP keepalives set below the lowest idle timeout in the path (Linux default of 2 hours is too long), connection pool validation or max lifetime, and retry on stale connections.

21. Slow page: network, TLS, or app? Use curl -w timing: high time_namelookup means DNS, time_connect minus lookup means TCP/RTT, time_appconnect minus connect means TLS, time_starttransfer minus appconnect means server think time (app/backend), and time_total minus starttransfer means download. Compare from multiple locations and against the origin directly to separate CDN or proxy effects.

22. Loss at a middle hop in mtr. Routers deprioritize replying to ICMP, so loss at one hop that disappears at later hops is just ICMP rate limiting, not real loss. Real loss shows at that hop and persists to all hops after it, including the destination. Confirm with an actual-protocol test (iperf3, TCP-based mtr with -T -P 443).

23. Same subnet, cannot reach each other. Both reach the gateway, so the link is up. Check ARP (ip neigh showing FAILED/INCOMPLETE), the netmask (one host may have a wrong mask, thinking the peer is off-subnet), host firewalls, VLAN or port-security settings, and duplicate IPs or MACs. In clouds, check security groups and NSGs for intra-subnet rules, since they are not always open by default.

24. Breaks at failover. Likely causes: connection state is not synchronized between firewalls, so existing sessions are dropped and clients must reconnect. Or the new active node announces the virtual IP slowly (gratuitous ARP), or routing converges slowly. Fix with stateful session sync, fast failure detection (BFD, short VRRP timers), and clients that retry with backoff.

25. What happens when you open https://example.com.

Browser checks its caches and HSTS list.
DNS lookup: stub resolver → recursive resolver → root/TLD/authoritative, returning A/AAAA (cached by TTL).
The host checks its route table. The destination is off-subnet, so it ARPs for the default gateway’s MAC, and builds the frame to it.
TCP 3-way handshake to port 443 (routers forward hop by hop, NAT may rewrite the source).
TLS handshake: ClientHello with SNI and ALPN, server certificate, key exchange, and verification of the chain, expiry, and hostname.
HTTP request (HTTP/2 or 3 if negotiated) with Host header. A CDN, load balancer, or reverse proxy may handle it, then reach the backend.
The response comes back, the browser parses it and loads further resources, reusing the connection where possible.
The connection stays alive for reuse, then closes with FIN or times out.

26. “Service A cannot talk to Service B.”

Get precision: source, destination name, port, protocol, exact error, and since when. Did anything change recently?
Resolve the name from the source with dig and confirm it is the right IP.
Check the route with ip route get, then mtr for the path.
Test the port with nc -zv. Timeout means a firewall or route issue. Refused means nothing is listening.
Check the layers of filtering: host firewall, security groups/NSGs, ACLs, and intermediate firewalls. Look at counters and logs.
On the destination, confirm the service listens on the right interface with ss -tulpn, and run tcpdump to see traffic arrive and replies leave.
Test TLS with openssl s_client, then HTTP with curl -v.
Check app logs and timeouts across all hops.
Compare with a working source to isolate what differs, and change one thing at a time.

Rapid-Fire Questions to Practice

Difference between a hub, switch, and router?
What happens if two hosts have the same IP?
Why is ARP not needed across routers?
How does a switch learn MAC addresses?
What is the difference between a collision domain and a broadcast domain?
Explain SYN flood and how SYN cookies help.
Why does TCP need TIME_WAIT?
What is the difference between flow control and congestion control?
Why is UDP used for DNS and QUIC?
What is the difference between recursive and authoritative DNS?
Why can’t a CNAME exist at the zone apex?
What does ndots:5 do?
What is the difference between 502, 503, and 504?
What is SNI and why is it needed?
What is forward secrecy?
Difference between SNAT, DNAT, and PAT?
Difference between L4 and L7 load balancing, and when would you choose each?
Why is VPC peering non-transitive?
What is anycast and where is it used?
How would you design a network for a multi-tier app with public and private tiers?
What does traceroute do under the hood?
How do you detect and handle an MTU problem?