Network engineer interview questions

As asked

Traffic to your public service suddenly starts routing through an unexpected provider and latency triples. How would you investigate and respond to a possible BGP route leak?

Sample answer outline

Start with external visibility: route collectors, looking glasses, RPKI status, traceroutes from multiple regions, and provider status channels. Confirm whether your prefixes are being originated or propagated incorrectly, then work with upstream providers to filter or withdraw bad routes. Ensure your own route objects, ROAs, prefix filters, and max-prefix limits are correct before blaming the internet. Mitigate user impact with traffic engineering, alternate providers, or CDN routing where available. Candidates should understand that BGP convergence and provider coordination are operational realities, not instant local fixes.

Expect these follow-ups

• How does RPKI help, and what does it not prevent?
• What prefix filtering would you expect from a responsible upstream?
• How would you communicate customer impact during a routing incident?

As asked

Walk me through the full BGP best-path selection algorithm in order. Where do Weight, LOCAL_PREF, AS_PATH, MED, and IGP cost each fit, and which attributes are locally significant versus propagated to peers?

Sample answer outline

A strong answer lists the full decision process: highest Weight (Cisco-local), highest LOCAL_PREF (iBGP-propagated), locally originated, shortest AS_PATH, lowest Origin code, lowest MED (compared only between routes from same AS), eBGP over iBGP, lowest IGP cost to next-hop, then tiebreakers. Candidate distinguishes locally significant attributes from those crossing AS boundaries and knows that MED comparison is disabled by default when routes come from different ASes.

Expect these follow-ups

• If two eBGP peers advertise the same prefix and all attributes tie, what finally breaks the tie?
• How do you influence inbound traffic from a remote AS when you can only set outbound BGP attributes?

As asked

Describe exactly what happens at the packet level during TCP connection setup and teardown, including the sequence and acknowledgment number mechanics. What can go wrong at each step, and how does TIME_WAIT affect a server under load?

Sample answer outline

Answer covers SYN, SYN-ACK, ACK with ISN selection; four-way FIN/FIN-ACK teardown; and the 2MSL TIME_WAIT state that holds the local port pair. Strong candidates explain that TIME_WAIT prevents stale segments from a previous connection being misinterpreted, that high-connection-rate servers can exhaust ephemeral ports, and mitigations such as SO_REUSEADDR, tcp_tw_reuse, or reducing 2MSL via sysctl.

Expect these follow-ups

• What is TCP RST and when would you send one instead of a FIN?
• How does TCP Fast Open skip the handshake latency and what security risks does it introduce?

As asked

A browser on a corporate laptop queries example.com for the first time. Walk me through every step from the stub resolver through the recursive resolver, root servers, TLD servers, and authoritative servers. What caching happens at each layer, and how do negative caches and NXDOMAIN TTLs work?

Sample answer outline

Answer traces: OS stub resolver checks local cache and /etc/hosts, forwards to recursive resolver (usually ISP or corporate DNS), recursive resolver checks its cache, then iteratively queries root for .com NS, TLD for example.com NS, then authoritative NS for the A record. Caching is governed by TTL on each RRset. Negative caching (RFC 2308) caches NXDOMAIN for the SOA MINIMUM TTL. Strong candidates mention DNSSEC chain of trust and how a broken DS record can black-hole a domain.

Expect these follow-ups

• What is the difference between an authoritative and a recursive resolver, and why should they not run on the same host?
• How does DNS over HTTPS change the trust model compared to plain DNS?

As asked

Compare stateful inspection to simple packet filtering. How does a stateful firewall track TCP connections in its session table, what happens when asymmetric routing breaks that tracking, and how do you handle UDP pseudo-sessions?

Sample answer outline

Packet filtering evaluates each packet independently against ACL tuples; stateful inspection maintains a connection table keyed on 5-tuple and validates that packets belong to an established flow. Asymmetric routing means return traffic arrives on a different firewall instance with no matching session entry, causing drops. Mitigations include session sync between HA pairs, ECMP flow pinning, or moving to a stateless design for specific traffic. UDP pseudo-sessions use a configurable idle timeout since there is no SYN/FIN to anchor state.

Expect these follow-ups

• How does a next-generation firewall layer application inspection on top of stateful tracking?
• What is the security risk of the SYN flood and how does SYN cookie protect the session table?

As asked

A customer reports that API calls to our service take 3+ seconds sporadically. You SSH to the server. Without installing anything, walk me through the exact tcpdump command you would run, what fields in the capture you would look at, and how you would identify whether the delay is in the network, the server, or the client.

Sample answer outline

Run tcpdump with -nn (no name resolution), -s 0 (full packet), -w to file for Wireshark, filtering on the customer IP and port. Look at TCP timestamps: time from client SYN to server SYN-ACK measures network RTT; time from client sending the request (PSH+ACK) to server first response byte measures server processing time; time from server last byte to client ACK measures return network time. Retransmits (duplicate ACKs, RTO events), zero-window advertisements, or delayed ACKs (40ms gaps) all point to specific layers.

Expect these follow-ups

• How would you identify TCP retransmits specifically with tcpdump output rather than Wireshark?
• What is TCP delayed ACK and when does it interact badly with Nagle's algorithm?