Network engineer technical fundamentals interview questions

As asked

Map BGP, OSPF, ARP, ICMP, TLS, and VXLAN to their OSI layers, and explain how packets from a Layer 7 application pass down and back up the stack when crossing a routed network. Where does each protocol's header get added and stripped?

Sample answer outline

Application data is passed to TCP/UDP (L4) which adds port header; IP (L3) adds src/dst IP; Ethernet (L2) adds MAC addresses, resolved via ARP. On the wire (L1) bits are transmitted. At each router, L2 header is stripped and re-written with new src/dst MAC for the next hop; L3 IP header TTL is decremented but src/dst IP unchanged end-to-end. ARP is L2 (between L2 and L3). ICMP is L3. TLS is between L4 and L7 (session layer). OSPF runs over IP (L3). BGP runs over TCP (L4). VXLAN encapsulates at L2 and carries it over L3.

Expect these follow-ups

• Why does ARP not exist in IPv6 and what replaces it?
• At which OSI layer does a load balancer operate when it inspects HTTP headers to make routing decisions?

As asked

You are designing a real-time network telemetry system that streams counter data from 10,000 devices every second. Should it use TCP or UDP for transport? What are the tradeoffs at scale and what do you lose by choosing UDP?

Sample answer outline

TCP's per-connection state and congestion control create head-of-line blocking and high memory/CPU overhead for 10,000 connections sending 1 Hz updates. UDP suits real-time telemetry where the latest counter value is more valuable than guaranteed delivery of an old one; a missed packet just means a gap in the time series, not a service failure. Tradeoffs: UDP has no retransmission (lost packets mean gaps), no flow control (need to rate-limit producers to avoid overwhelming collectors), no ordering guarantees. Many gNMI streaming telemetry implementations use gRPC over HTTP/2 over TCP but tune connection pooling to reduce overhead.

Expect these follow-ups

• How does QUIC attempt to combine UDP's performance with TCP's reliability and ordering?
• What is head-of-line blocking in TCP and how does HTTP/2 multiplexing help but not fully solve it?

As asked

You need to allocate IP space from 192.168.0.0/22 for three segments: one segment needing 500 hosts, one needing 100 hosts, and one needing 20 hosts, leaving the remainder unallocated. What subnets do you allocate and in what order to minimize waste?

Sample answer outline

Allocate largest first to ensure alignment: 500 hosts needs a /23 (510 usable); 100 hosts needs a /25 (126 usable); 20 hosts needs a /27 (30 usable). Allocate: 192.168.0.0/23 for 500-host segment, 192.168.2.0/25 for 100-host segment, 192.168.2.128/27 for 20-host segment. Remainder: 192.168.2.160/27, 192.168.2.192/26, 192.168.3.0/24 are unallocated. Candidate should explain that allocating largest-first preserves alignment and avoids fragmentation of the remaining space.

Expect these follow-ups

• What is the network address and broadcast address for 192.168.2.128/27?
• How does VLSM (Variable Length Subnet Masking) differ from classful subnetting?

As asked

Explain how 802.1Q VLAN tags work at the Ethernet frame level, the difference between access and trunk ports, what the native VLAN is, and why a native VLAN mismatch between two trunk ports can be a security risk.

Sample answer outline

802.1Q inserts a 4-byte tag (TPID 0x8100 + PCP + DEI + 12-bit VLAN ID) between src MAC and Ethertype. Trunk ports carry multiple VLANs with tags; access ports strip/insert the tag transparently to the endpoint. The native VLAN is sent untagged on a trunk. If two switches have different native VLANs configured on a trunk (say SW1 native=1, SW2 native=10), then untagged frames from VLAN 1 on SW1 arrive on SW2 and are assigned to VLAN 10, enabling VLAN hopping. Best practice: set native VLAN to an unused VLAN, and tag it explicitly with 'vlan dot1q native'.

Expect these follow-ups

• How does a double-tagging VLAN hopping attack work and why does the attacker need to be on the native VLAN?
• What is QinQ (802.1ad) and when is it used in service provider networks?

As asked

Walk me through how a router processes an incoming packet: the lookup sequence from interface arrival through MAC decapsulation, IP validity checks, TTL handling, routing table lookup with longest-prefix match, ARP resolution for next-hop, and Ethernet re-encapsulation before forwarding.

Sample answer outline

Packet arrives on interface, L2 header is stripped (validated dst MAC matches router's MAC). IP checksum is verified, TTL checked (if TTL=1, drop and send ICMP Time Exceeded). Routing table LPM lookup on dst IP returns outgoing interface and next-hop IP. If next-hop not in ARP cache, ARP request sent (packet queued). Once next-hop MAC is resolved, new Ethernet frame built with router's outgoing interface MAC as src and next-hop MAC as dst, TTL decremented, checksum recalculated, frame forwarded. In hardware forwarding (ASIC), this entire pipeline runs at line rate in nanoseconds.

Expect these follow-ups

• What is Cisco Express Forwarding (CEF) and why does it separate the RIB from the FIB?
• How does a router handle a packet destined for one of its own IP addresses versus one it needs to forward?

As asked

Users in one region cannot resolve api.example.com, while other regions are fine. Walk me through your DNS debugging process.

Sample answer outline

Check resolution from affected and unaffected recursive resolvers, then query authoritative nameservers directly to separate resolver cache problems from zone problems. Inspect TTLs, recent changes, DNSSEC validation failures, delegation, glue records, and geo-DNS or latency-based routing policies. Compare A, AAAA, CNAME, and ALIAS behaviour because IPv6 or a broken CNAME target can look regional. Use logs from managed DNS where available and confirm whether the issue is resolver-specific, ISP-specific, or authoritative. Weak answers stop at flushing cache and miss delegation or DNSSEC failures.

Expect these follow-ups

• How can a DNSSEC issue affect only some resolvers?
• What TTL would you choose before a planned cutover?
• How do you prove the application is healthy once DNS is fixed?

As asked

List the most operationally important ICMP message types (at least 6), explain what each signals, and give a concrete network engineering scenario where each appears during troubleshooting.

Sample answer outline

Echo Request (Type 8) and Echo Reply (Type 0): ping, basic reachability. Destination Unreachable (Type 3): sub-codes matter (Code 0=Net unreachable=no route, Code 1=Host unreachable=ARP failure, Code 3=Port unreachable=UDP traceroute probe response, Code 4=Fragmentation Needed, used by PMTUD). Time Exceeded (Type 11, Code 0): TTL expired, basis of traceroute. Redirect (Type 5): router tells host to use a better first-hop. Source Quench (Type 4): deprecated congestion signal. Router Advertisement and Solicitation (Types 9 and 10): used by IRDP. Candidate should know that Type 3 Code 4 and Type 11 must not be filtered, as doing so breaks PMTUD and traceroute respectively.

Expect these follow-ups

• Why is filtering all ICMP on a firewall considered a bad practice and which types should always be allowed?
• How does ICMPv6 take on roles beyond ICMPv4 (neighbor discovery, router solicitation)?

As asked

List all RFC 1918 private address ranges, the IPv4 loopback range, link-local range, and APIPA range. For each, explain whether they are routable on the public internet and what happens if a router receives a packet with one as a destination from an upstream interface.

Sample answer outline

RFC 1918: 10.0.0.0/8, 172.16.0.0/12 (172.16-172.31), 192.168.0.0/16. Loopback: 127.0.0.0/8. Link-local: 169.254.0.0/16 (APIPA). None are routable on the public internet; ISPs implement BCP 38 ingress filtering and should drop packets with these source addresses arriving from customers. If a public router receives a packet destined for 10.x.x.x and has no specific route, it hits the default route or is dropped. Best practice is to filter these at network edges as martian routes.

Expect these follow-ups

• What is BCP 38 and why do not all ISPs implement it?
• What is the RFC 5737 documentation address range and why does it exist?

As asked

Explain how TCP Tahoe, Reno, CUBIC, and BBR approach congestion control differently. What problem does BBR solve that loss-based algorithms like CUBIC do not, and when would you tune tcp_congestion_control on a Linux server?

Sample answer outline

Tahoe/Reno: AIMD, slow-start, congestion window halved on packet loss. CUBIC: loss-based like Reno but with a cubic function for window growth, better for high-bandwidth-delay paths. Problem: loss-based algorithms mistake bufferbloat-induced loss for congestion, running the link below its actual capacity. BBR: model-based, estimates bottleneck bandwidth and minimum RTT, fills the pipe without filling the buffer, achieves higher throughput on lossy paths (satellite, mobile). Tune on servers with long-fat network paths (WAN file transfer, streaming) or where you observe RTT inflation under load.

Expect these follow-ups

• What is bufferbloat and why does it inflate RTT without being true congestion?
• How does QUIC implement its own congestion control independently of the OS TCP stack?

As asked

Compare the IPv4 and IPv6 headers. What fields were removed in IPv6, what was added, why was fragmentation moved out of the main header, and how does this affect routers' forwarding performance?

Sample answer outline

IPv6 header is fixed at 40 bytes versus variable IPv4. Removed: checksum (handled at L4, removing per-hop checksum recalc improves router speed), header length field (now fixed), fragmentation fields (moved to optional Extension Headers), IHL. Added: Flow Label (identifies a flow for QoS without parsing L4 headers), Traffic Class (like DSCP+ECN). Fragmentation: only the source may fragment in IPv6 (routers return ICMPv6 Packet Too Big); this simplifies router processing and forces path MTU discovery. Fixed header length means hardware can parse the header at fixed offsets, improving ASIC forwarding.

Expect these follow-ups

• What is the IPv6 Extension Header and what types exist?
• Why does IPv6 eliminate the IPv4 header checksum and what ensures data integrity instead?

As asked

Describe the behavioral difference between full cone, address-restricted cone, port-restricted cone, and symmetric NAT. Why does the NAT type matter for peer-to-peer applications like WebRTC and gaming, and which combination of NAT types allows direct peer connectivity?

Sample answer outline

Full cone (one-to-one NAT): once a mapping is created, any external host can send to the mapped port. Address-restricted: only the external host that the internal host sent to can send back. Port-restricted: only the exact IP+port the internal host sent to. Symmetric: different external port is allocated per destination, making predictions impossible. For P2P: full cone to full cone works; symmetric-to-symmetric almost never works without a relay (TURN). ICE/STUN performs NAT traversal by having peers discover their mapped addresses and attempting simultaneous hole-punching.

Expect these follow-ups

• What is STUN and how does it help a client behind NAT discover its public IP and port?
• Why does symmetric NAT break STUN-based hole punching and how does TURN work as a fallback?