Networking

A network looks transparent while it works and utterly opaque when it breaks. An operations engineer does not design backbones but must be able to trace a packet's path: how a name becomes an address, how an address becomes a MAC, where a packet leaves the host, and why the firewall silently swallowed it. Most "mysterious" incidents are a stale /etc/hosts entry, a blocked ICMP, an exhausted NAT table, or a wrong subnet mask — not "the network being flaky".

This topic is laid out bottom-up — from the frame and ARP to routing, NAT, and perimeter defence. We deliberately name the traps interviews are built on: SSH is application-layer, not transport; ARP does not cross routers; the longest prefix wins, not the shortest; voice runs over UDP not "because it is faster" but because a late retransmit is useless. All the teaching lives in the layers below; this page is only the map.

Topic map

• The OSI model — seven layers as a coordinate system and which one a switch, a router, and SSH live on.
• Ethernet frame & devices — the frame's fields, the CRC for error checking, and the difference between an L2 switch, an L3 switch, and a router.
• The ARP protocol — how a host finds a MAC for an IPv4 address by broadcasting within one segment.
• IPv4 subnetting — computing host counts from the prefix length and why two addresses are subtracted.
• The TCP three-way handshake — the SYN → SYN-ACK → ACK exchange and sequence-number synchronization.
• TCP versus UDP — reliability and ordering versus low latency, and why voice chooses UDP.
• DNS resolution — a recursive resolver walking the hierarchy, server roles, TTL caching, and UDP/53 transport.
• The /etc/hosts file & resolution order — how nsswitch.conf puts the local file ahead of DNS and how to debug it.
• The curl request path — the full lifecycle of curl https://… from $PATH and DNS to TLS and HTTP.
• Checking port reachability — telnet, nc, nmap versus the false "the ping worked, so the port is open".
• Next-hop selection — longest prefix match, administrative distance, and the RIB/FIB split.
• NAT, SNAT, DNAT, PAT — address rewriting at a boundary and how source, destination, and port translation differ.
• Dynamic routing — the distance-vector, link-state, and path-vector families and BGP fundamentals.
• Load balancing — round-robin, least-connections, ip-hash, and session stickiness.
• The FTP connection — two channels, active versus passive mode, and getting along with NAT.
• Path MTU Discovery — finding the largest packet via ICMP and the black hole when it is blocked.
• AAA & RADIUS/TACACS+ — the three A's of access control and how RADIUS differs from TACACS+.
• DDoS categories — volumetric, protocol, and application-layer attacks and why each hits a different resource.

Common traps

Interview relevance

Networking is the favourite way to test whether you think in mechanisms or memorised definitions. A strong answer traces the path: "name → /etc/hosts/DNS → IP → ARP/route → TCP handshake → TLS → HTTP". A candidate who answers "what happens on curl" by walking that chain step by step immediately gets ahead of "well, a request is sent".

Typical checks:

• The OSI layers and which one a switch (L2), a router (L3), and SSH (L7) work on.
• A quick mental subnet calculation and the awareness that the network and broadcast addresses are not assigned to hosts.
• The name-resolution order and why ping and nslookup can return different IPs.
• The TCP/UDP difference, SNAT/DNAT/PAT, and next-hop selection by prefix length and administrative distance.

Common wrong answer: "the ping worked, so the service is up". ping confirms only ICMP host reachability; the port may be closed, the application may have crashed, and the firewall may be filtering exactly the TCP traffic. Test port reachability with telnet, nc -zv, or nmap.