Overview
This topic collects the questions that come up most often in networking interviews, from entry-level support roles to network engineering positions. Each question is paired with a direct answer you can adapt in your own words. Use these as a review checklist rather than a script to memorize verbatim.
Cricket analogy: This is like a fast bowler's pre-series checklist of the deliveries he must have ready — yorker, bouncer, slower ball — reviewed and adapted to the pitch rather than memorized as one rigid routine, just as these interview questions are a review checklist to adapt in your own words.
What is the difference between the OSI model and the TCP/IP model?
The OSI model is a 7-layer conceptual reference (Physical, Data Link, Network, Transport, Session, Presentation, Application) used mainly for teaching and troubleshooting. The TCP/IP model is the 4-layer model (Network Access/Link, Internet, Transport, Application) that actually underlies the modern internet and maps loosely onto OSI, with Session, Presentation, and Application collapsed into a single Application layer.
Cricket analogy: The MCC's exhaustive 7-part Laws of Cricket document is used mainly for teaching and settling disputes, while the actual on-field play really runs on a simpler 4-part practical framework — bowl, field, bat, umpire — collapsing several rule sections into one practical layer, mirroring OSI's teaching model versus TCP/IP's practical 4-layer model.
Explain the TCP three-way handshake.
TCP establishes a connection with three segments: the client sends a SYN with an initial sequence number, the server replies with SYN-ACK acknowledging that number and sending its own initial sequence number, and the client responds with an ACK. After this exchange both sides have agreed on sequence numbers and the connection is considered established.
Cricket analogy: A player requesting to join a net session (SYN), the coach confirming a spot is open and asking them to bring their own kit (SYN-ACK), and the player confirming they're bringing it (ACK) — three exchanges before the actual session can start, just like TCP's three-way handshake.
What is the difference between TCP and UDP?
TCP is connection-oriented, provides reliable ordered delivery, and uses acknowledgments plus flow and congestion control, which adds overhead and latency. UDP is connectionless with no delivery guarantees or ordering, but has minimal overhead, which makes it suitable for DNS lookups, streaming media, and VoIP where speed matters more than guaranteed delivery.
Cricket analogy: Test cricket is like TCP — every ball is accounted for, umpires review decisions, and the game proceeds carefully with checks at every stage, while T10 cricket is like UDP — fast, minimal overhead, and willing to accept the occasional missed detail for speed, which suits quick formats the way UDP suits DNS lookups.
What happens when you type a URL into a browser and press Enter?
The browser first checks its cache for a DNS resolution of the hostname; if not cached, it performs a DNS lookup to get an IP address. It then opens a TCP connection to that IP (typically port 443 for HTTPS), performs a TLS handshake, sends an HTTP request, and the server returns an HTTP response that the browser parses and renders, issuing further requests for embedded resources as needed.
Cricket analogy: A team first checks if they already know an opponent's playing style from past scouting (DNS cache), if not they research it fresh (DNS lookup), then arrange the match venue (TCP connect), verify both teams' credentials with match officials (TLS handshake), play the actual innings (HTTP request/response), and follow up with press conferences afterward (further requests for embedded resources).
What is a subnet mask and why is subnetting used?
A subnet mask defines which bits of an IP address represent the network portion and which represent the host portion. Subnetting divides a large network into smaller logical segments, which reduces broadcast domain size, improves security through isolation, and allows more efficient allocation of address space.
Cricket analogy: Dividing a large stadium complex into separate practice net areas (subnets) with clear boundary markers (the mask) reduces the chaos of every ball being chased across the whole ground (smaller broadcast domain), keeps junior academy players isolated from the senior squad for safety (security via isolation), and lets each net be sized to the number of players actually using it (efficient allocation).
What is the difference between a hub, a switch, and a router?
A hub is a simple physical-layer device that repeats incoming signals to all ports, creating one collision domain. A switch operates at the data link layer, learns MAC addresses, and forwards frames only to the port where the destination device lives, creating separate collision domains per port. A router operates at the network layer and forwards packets between different networks based on IP addresses.
Cricket analogy: A hub is like a stadium PA that blares every announcement to every stand at once with one shared echo (one collision domain); a switch is like ushers who quietly direct each message only to the relevant stand (separate collision domains); a router is like the transport office that moves entire teams between different stadiums across cities (forwarding between networks).
What is NAT and why is it needed?
Network Address Translation rewrites private IP addresses to a public IP address (and back) as traffic crosses a router or firewall. It conserves scarce public IPv4 addresses by letting many internal hosts share one external address, and it also hides internal network topology from outside observers.
Cricket analogy: A cricket academy sends all its junior players' correspondence out under the head coach's single official letterhead address, rewriting each player's internal room number to the one public academy address and back, conserving the club's limited number of official letterheads while hiding which room each junior actually trains in, just like NAT.
What is DNS and how does resolution work?
DNS is a distributed, hierarchical naming system that translates human-readable domain names into IP addresses. A resolver queries a recursive DNS server, which in turn walks the hierarchy from root servers to top-level-domain servers to authoritative name servers until it finds the answer, then caches and returns it to the client.
Cricket analogy: Finding out which ground a specific match is being played at works like DNS — you ask a general information desk (recursive resolver), which checks the national board's directory (root), then the regional association's listing (TLD), then finally the specific stadium's own booking office (authoritative server) for the exact address, then remembers it for next time (caching).
What is the difference between a firewall and a load balancer?
A firewall enforces security policy by allowing or blocking traffic based on rules such as IP address, port, or protocol. A load balancer distributes incoming traffic across multiple backend servers to improve availability and performance. The two solve different problems and are often deployed together in front of an application.
Cricket analogy: A stadium's security checkpoint deciding who's allowed onto the field based on accreditation badges is like a firewall enforcing rules by identity, while the groundstaff directing incoming spectators evenly across multiple entry gates to avoid crowding one gate is like a load balancer — different problems, both needed for a smooth match day.
What is DHCP and what problem does it solve?
DHCP automatically assigns IP addresses and related configuration (subnet mask, default gateway, DNS servers) to hosts on a network. It eliminates the need for manual IP configuration on every device and prevents address conflicts by leasing addresses for a defined period.
Cricket analogy: A cricket academy automatically assigns each new junior player a locker, a kit set, and a coach for the season without anyone manually configuring it by hand, and the assignment is only for that season's "lease" so it can be reassigned to a new player next year, just like DHCP auto-assigning IP configuration for a lease period.
How would you troubleshoot a host that cannot reach the internet?
A methodical approach works bottom-up: check the physical link and interface status, verify the host has a valid IP address and correct subnet mask, ping the default gateway, then ping a known external IP to isolate DNS versus routing issues, and finally attempt DNS resolution and an HTTP request to confirm application-layer reachability.
Cricket analogy: A coach diagnosing a batsman's slump works bottom-up: first check the bat and grip are physically sound (physical link), then confirm basic stance and footwork are correct (valid IP/mask), then test against a simple throwdown (ping the gateway), then test against a net bowler (ping external IP), and finally review video against match footage to pinpoint exactly what's failing (DNS resolution and HTTP request equivalent).
- OSI has 7 layers, TCP/IP has 4 layers
- TCP handshake: SYN, SYN-ACK, ACK
- TCP is reliable and ordered; UDP is fast and connectionless
- Switches forward by MAC address; routers forward by IP address
- NAT conserves public IPv4 addresses and hides internal topology
- DHCP automates IP address assignment
- Interviewers usually favor a clear, structured answer over an exhaustive one
- Being able to explain a concept with a real-world analogy signals genuine understanding
- Practice walking through troubleshooting scenarios out loud, not just reciting definitions
Practice what you learned
1. How many layers does the OSI model define?
2. What is the correct order of the TCP three-way handshake?
3. Which device forwards traffic based on MAC addresses?
4. What is the primary purpose of NAT?
5. Which protocol is preferred for real-time voice/video where low latency matters more than guaranteed delivery?
Was this page helpful?
You May Also Like
The OSI Model
Understand the 7 layers of the OSI reference model, their responsibilities, and example protocols at each layer.
The TCP/IP Model
Learn the 4-layer TCP/IP model and how it maps to the 7 OSI layers.
The TCP Three-Way Handshake
Trace how TCP establishes a reliable connection using the SYN, SYN-ACK, and ACK exchange.
DNS: The Domain Name System
How DNS translates human-friendly domain names into IP addresses through a distributed hierarchy of resolvers and servers.
Network Troubleshooting Tools
Learn how ping, traceroute, netstat/ss, and nslookup/dig work under the hood to diagnose connectivity, routing, and DNS issues.