Computer Networks Questions

Computer networking is the system of interconnecting multiple computing devices, such as servers, PCs, and printers, to exchange data and share resources. It relies on a combination of hardware components and software protocols that allow devices to communicate wirelessly or via physical cables.

A Hub broadcasts data to all ports, causing congestion. A Switch is intelligent, using MAC addresses to send data to specific ports. A Router connects different networks (like LAN to WAN) and uses IP addresses to determine the best path for data packets to reach their destination.

TCP is a connection-oriented protocol that ensures reliable data delivery through handshaking and error checking. UDP is a connectionless protocol that is much faster but does not guarantee packet delivery or order, making it ideal for real-time applications like video streaming and online gaming.

An IP address is a unique numerical label assigned to each device on a network. IPv4 uses a 32-bit format (e.g., 192.168.1.1) supporting 4.3 billion addresses. IPv6 uses 128-bit hexadecimal notation, providing an almost infinite number of addresses to solve the global exhaustion of IPv4.

A MAC address is a permanent, unique physical identifier assigned to a device's Network Interface Card (NIC). While an IP address identifies a device's logical location on a network (which can change), the MAC address identifies the hardware itself and is usually hardcoded by the manufacturer.

A public IP address is used to communicate over the internet and is globally unique. A private IP address is used within a local network (LAN) and is not routable on the internet, allowing multiple devices inside a home or office to share a single public IP via NAT.

A port number is a communication endpoint used by the transport layer to direct data to specific services. Common examples include Port 80 for HTTP, Port 443 for HTTPS, Port 22 for SSH, and Port 25 for SMTP, helping the OS distinguish between different types of incoming traffic.

DNS (Domain Name System) translates human-readable domain names like 'google.com' into machine-readable IP addresses. When a user enters a URL, a DNS resolver queries root, TLD, and authoritative name servers to find the matching IP, effectively acting as the internet's phonebook for routing traffic.

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network parameters to devices. It uses the DORA process: Discovery (client asks for IP), Offer (server suggests IP), Request (client accepts), and Acknowledgment (server confirms), ensuring efficient IP management without manual configuration.

HTTP transmits data in plain text, making it vulnerable to interception. HTTPS is the secure version that uses SSL/TLS encryption to protect data between the browser and server, ensuring data integrity and privacy, which is crucial for sensitive activities like banking or logging in.

A Gateway is a network node that acts as an entry and exit point for data moving between different networks. It handles protocol translation and routing, typically serving as the interface between a local area network (LAN) and a wide area network (WAN) like the internet.

A subnet mask is a 32-bit number used to distinguish the network portion of an IP address from the host portion. It helps devices determine if an IP address belongs to the local network or a remote one, which is essential for routing decisions and efficient IP allocation.

NAT is a method used by routers to translate multiple private IP addresses within a local network into a single public IP address. This conserves the limited supply of IPv4 addresses and adds a layer of security by hiding internal network structures from the public internet.

Localhost refers to the current machine being used to access it. The IP address 127.0.0.1 is the loopback address used by a computer to communicate with itself. This is primarily used for testing network software and services locally without needing an active external network connection.

Bandwidth is the maximum volume of data that can be transmitted over a network in a given time (measured in Mbps). Latency is the time delay it takes for a data packet to travel from the source to the destination and back (measured in milliseconds).

The OSI model is a conceptual framework for networking that consists of seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. It standardizes communication functions so that different hardware and software systems can interact seamlessly regardless of their underlying architecture.

The OSI model is a theoretical 7-layer reference model, whereas the TCP/IP model is a 4-layer (or 5-layer) practical model used in modern networking. TCP/IP combines the top three OSI layers (Application, Presentation, Session) into one Application layer and is more focused on internet protocols.

Physical handles cables/bits; Data Link handles MAC/frames; Network handles IP/routing; Transport handles segments/reliability; Session manages connections; Presentation handles encryption/formatting; and Application provides user interfaces for software like web browsers and email clients to access network services.

The Network Layer (Layer 3) is responsible for routing data packets. It uses logical addressing (IP addresses) and routing tables to determine the most efficient path for a packet to travel across interconnected networks from the source to its final destination.

Error detection occurs primarily at the Data Link Layer (Layer 2) using techniques like CRC (Cyclic Redundancy Check) in frames. Additionally, the Transport Layer (Layer 4) ensures end-to-end reliability by verifying that data segments arrived intact and requesting retransmission if they are corrupted.

The Transport Layer provides end-to-end communication services. It handles segmentation, flow control, and error correction. Protocols like TCP ensure reliable, ordered delivery, while UDP provides fast, low-overhead transmission, both using port numbers to target specific applications on the host machine.

The Network Layer is responsible for logical addressing and routing. It encapsulates data into packets and chooses the best physical path for those packets to take using protocols like IP and ICMP, ensuring that data can move between different local networks globally.

The Data Link Layer handles physical addressing and data framing. It manages how data is placed on the physical medium and ensures error-free transmission between two directly connected nodes. It is further divided into the Logical Link Control (LLC) and Media Access Control (MAC) sublayers.

Encapsulation is the process of adding headers (and trailers) to data as it moves down the OSI layers from Application to Physical. Decapsulation is the reverse process where the receiving device strips those headers at each layer to retrieve the original user data.

A PDU is the specific form that data takes at each layer of the OSI model. For example, at the Physical layer it is 'Bits', at Data Link it is 'Frames', at the Network layer it is 'Packets', and at the Transport layer it is 'Segments' (TCP) or 'Datagrams' (UDP).

Physical: Ethernet, DSL; Data Link: PPP, MAC; Network: IP, ICMP, ARP; Transport: TCP, UDP; Session: NetBIOS; Presentation: SSL, JPEG, MPEG; Application: HTTP, FTP, DNS, SMTP. Understanding this mapping is crucial for troubleshooting connectivity issues across different stages of communication.

A Layer 2 switch uses MAC addresses to forward data within a single local network. A Layer 3 switch (Multilayer Switch) has the capabilities of a switch but can also perform routing based on IP addresses, allowing it to move traffic between different VLANs or networks efficiently.

The Application Layer is the top layer that interacts directly with user software. It is responsible for providing network services to applications, such as identifying communication partners, determining resource availability, and synchronizing communication via protocols like HTTP, FTP, and Telnet.

A layered model like OSI or TCP/IP simplifies network design by breaking complex processes into manageable parts. It allows hardware and software from different vendors to work together and ensures that changes in one layer (like upgrading a cable) do not require changes in others.

The Session Layer is responsible for establishing, managing, and terminating sessions between applications. It handles synchronization points and ensures that if a connection is lost, it can be resumed from the last checkpoint rather than starting the entire data transfer from the beginning.

To establish a connection, the client sends a SYN (Synchronize) packet to the server. The server responds with a SYN-ACK (Synchronize-Acknowledgment) packet. Finally, the client sends an ACK (Acknowledgment) packet back to the server. This three-step process ensures both parties are ready for reliable data exchange.

These are flags in a TCP segment. SYN is a request to synchronize sequence numbers. SYN-ACK is the server's confirmation of the request and its own synchronization request. ACK is the final confirmation that confirms receipt of a previous segment, completing the connection setup.

TCP uses a four-step process to close a connection: 1. Host A sends a FIN packet. 2. Host B sends an ACK. 3. Host B sends its own FIN packet when ready to close. 4. Host A sends a final ACK. This ensures both sides have finished sending data.

A connection-oriented protocol (like TCP) requires a formal setup before data transfer and ensures delivery. A connectionless protocol (like UDP) sends data immediately without a handshake, offering faster speeds but no guarantee that the data will arrive or be in the correct order.

DNS primarily uses UDP because it is faster and involves small data queries. A single request/response cycle is much more efficient without the overhead of a TCP handshake. However, DNS may switch to TCP for large zone transfers or when the response exceeds 512 bytes.

ARP is used to map a known logical IP address to a physical MAC address on a local network. When a device needs to send data, it sends an ARP request asking 'Who has this IP?', and the owner responds with its MAC address so the frame can be delivered.

ICMP (Internet Control Message Protocol) is used by network devices to send error messages and operational information. The 'ping' utility uses ICMP 'Echo Request' and 'Echo Reply' messages to test the reachability of a host and measure the round-trip time for messages.

FTP is an older protocol that transmits data and credentials in plain text, making it insecure. SFTP (SSH File Transfer Protocol) provides the same functionality but encrypts both commands and data using an SSH tunnel, ensuring that file transfers are protected from eavesdropping and tampering.

SMTP is used to send emails from a client to a server or between servers. POP3 downloads emails from a server to a local device and usually deletes them from the server. IMAP synchronizes emails across multiple devices, allowing users to view the same messages everywhere.

SSH (Secure Shell) is a protocol used for secure remote login and other secure network services over an insecure network. It provides strong encryption and authentication to protect the communication session and typically operates on Port 22.

Telnet is an older remote login protocol that transmits data, including passwords, in unencrypted plain text. SSH is preferred because it encrypts the entire session, preventing hackers from using packet sniffers to steal sensitive login credentials and session data during remote management.

GET retrieves data from a server; POST submits new data to a server (like a form); PUT updates an existing resource entirely; and DELETE removes a specific resource. These methods form the basis of RESTful web services and define how clients interact with web resources.

Status codes indicate the result of an HTTP request. 200 means OK (Success); 404 means Not Found (Client error); 500 means Internal Server Error; 301 means Moved Permanently; and 403 means Forbidden. They are essential for debugging web application communication and SEO.

SSL/TLS are cryptographic protocols that provide security over a computer network. HTTPS works by using these protocols to encrypt the communication between a web browser and a server. It uses certificates and asymmetric/symmetric encryption to ensure that data cannot be read or modified by attackers.

A socket is one endpoint of a two-way communication link between two programs running on a network. It is uniquely identified by combining an IP address and a port number. Sockets allow applications to treat network connections like file streams for reading and writing data.

Class A (1-126) is for huge networks; Class B (128-191) for medium networks; Class C (192-223) for small networks; Class D (224-239) for Multicasting; and Class E (240-255) for research. This legacy system defined how the network and host portions of an IP were divided.

Subnetting is the practice of dividing a single large network into multiple smaller sub-networks. It is needed to reduce network congestion (by limiting broadcast domains), improve security, and allow for more efficient organization and management of a company's available IP address space.

A subnet mask is calculated by setting the network bits to '1' and host bits to '0'. For example, if you need a network with 254 hosts, you use a 24-bit mask (255.255.255.0). The number of hosts is calculated using the formula 2^n - 2, where n is the number of host bits.

CIDR (Classless Inter-Domain Routing) notation is a compact way to represent an IP address and its associated routing prefix. It uses a slash followed by the number of bits in the network mask (e.g., 192.168.1.0/24), replacing the older, more rigid Classful addressing system.

The private IP ranges are 10.0.0.0 to 10.255.255.255 (Class A), 172.16.0.0 to 172.31.255.255 (Class B), and 192.168.0.0 to 192.168.255.255 (Class C). These addresses are reserved for use within local networks and are not routable on the public internet.

A static IP address is manually assigned to a device and remains permanent until changed, making it ideal for servers. A dynamic IP address is automatically assigned by a DHCP server and can change periodically, which is more efficient for managing a large number of client devices.

APIPA is a feature in operating systems like Windows that automatically assigns a self-configured IP address in the range 169.254.0.1 to 169.254.255.254 when a DHCP server is unavailable. This allows local communication within a single subnet but does not provide internet access.

A loopback address is a virtual network interface used by a device to communicate with itself. In IPv4, the most common loopback address is 127.0.0.1. It is primarily used for troubleshooting and testing local network services without sending data over a physical network medium.

A broadcast address is a special network address used to transmit a message to every device on a specific network segment simultaneously. In an IPv4 network, the broadcast address is typically the highest address in a subnet, with all host bits set to 1.

A network address is an identifier for a specific subnet. It is the first address in an IP block (where all host bits are 0) and is used by routers to direct traffic to the correct destination network. It cannot be assigned to an individual host device.

IPv4 uses a 32-bit address space allowing for ~4.3 billion addresses, whereas IPv6 uses a 128-bit address space allowing for a virtually inexhaustible supply. IPv6 also includes built-in security (IPSec), simplified header structures, and eliminates the need for NAT in many scenarios.

We need IPv6 primarily because the global pool of available IPv4 addresses has been exhausted due to the rapid growth of the internet and IoT devices. IPv6 provides enough address space to give every device on the planet a unique, globally routable address without using NAT.

An IPv4 address is 32 bits in size, typically written as four decimal numbers separated by dots. An IPv6 address is 128 bits in size, written as eight groups of four hexadecimal digits separated by colons, offering significantly more addressing capacity for modern networks.

A /24 network provides 8 bits for hosts, which equals 2^8 or 256 addresses. However, two addresses are reserved: the network address (all 0s) and the broadcast address (all 1s). Therefore, a /24 network can accommodate a maximum of 254 usable host addresses.

Supernetting is the process of combining multiple smaller, contiguous subnets into a single larger network (a 'supernet'). It is the reverse of subnetting and is used primarily in route aggregation to reduce the size of routing tables and improve the efficiency of a router's memory.

Routing is the process of selecting the most efficient path for data packets to travel from a source to a destination across one or more networks. It is performed by a router, which uses routing protocols and tables to make forwarding decisions based on IP addresses.

A routing table is a data file stored in a router's RAM that contains a list of known network destinations and the specific 'next hop' or interface to reach them. The router consults this table for every incoming packet to determine where to forward it next.

Static routing involves manual configuration of routes by a network administrator, which is secure but not scalable. Dynamic routing uses protocols like OSPF or BGP to automatically discover networks and adjust routes in real-time based on network changes or link failures, offering better scalability.

A default gateway is the IP address of a router interface that acts as an exit point for traffic intended for a destination outside the local subnet. If a device doesn't know where to send a packet, it sends it to the default gateway for further routing.

Routing protocols are sets of rules that routers use to communicate and share information about network topology. Common examples include RIP (Distance Vector), OSPF (Link State), EIGRP (Hybrid), and BGP (Path Vector), each suited for different network sizes and types of administrative control.

RIP is a simple distance-vector protocol using hop count. OSPF is a link-state protocol that builds a complete map of the network for fast convergence. BGP is a path-vector protocol used to exchange routing information between different autonomous systems on the global internet.

Distance Vector protocols (like RIP) share their entire routing table with immediate neighbors at fixed intervals. Link State protocols (like OSPF) only share specific information about their local links with all routers in the area, resulting in faster convergence and less overall network traffic congestion.

Hop count is the number of routers or intermediate devices that a data packet must pass through to reach its destination. It is a common metric used by routing protocols like RIP to determine the 'best' path, where a lower hop count is preferred.

TTL is a field in an IP packet header that prevents packets from circulating indefinitely in a network loop. Every router that processes the packet decrements the TTL value by 1; if the TTL reaches 0, the packet is discarded and an ICMP error message is sent.

A switch operates at the Data Link Layer (Layer 2) and connects devices within a single local network using MAC addresses. A router operates at the Network Layer (Layer 3) and connects different networks together using IP addresses to route traffic between them.

A Virtual LAN (VLAN) allows a physical switch to be logically partitioned into multiple separate networks. It is used to improve security by isolating sensitive departments, reduce broadcast traffic, and allow devices to be grouped by function rather than their physical location in an office.

STP is a Layer 2 network protocol designed to prevent loops in a network with redundant paths. It identifies all paths between switches and automatically blocks some of them, creating a single tree-like structure. If a primary path fails, STP unblocks a redundant path to maintain connectivity.

Circuit switching (like phone calls) reserves a dedicated path for the duration of a session, ensuring constant quality but wasting bandwidth. Packet switching (like the internet) breaks data into packets and sends them independently, using shared bandwidth more efficiently but allowing for potential variable delays.

A virtual circuit is a logical connection between two network nodes that appears as a dedicated physical path but actually shares resources on a packet-switched network. It ensures that all packets follow the same path and arrive in the correct order, combining benefits of both switching methods.

Layer 2 devices, like standard switches, forward data based on hardware MAC addresses within a local subnet. Layer 3 devices, like routers or multilayer switches, forward data based on logical IP addresses, enabling communication between different subnets and wider networks like the internet.

A firewall is a security system that controls incoming and outgoing network traffic based on security rules. Types include Packet Filtering (checks headers), Stateful Inspection (tracks active sessions), Proxy Firewalls (acts as an intermediary), and Next-Generation Firewalls (includes deep packet inspection and antivirus features).

A stateless firewall examines each packet individually without considering previous traffic. A stateful firewall tracks the state of active network connections and only allows packets that are part of an established, legitimate session, providing significantly better security against complex network attacks.

A Virtual Private Network (VPN) creates an encrypted, secure 'tunnel' between a user's device and a remote server over a public network. It hides the user's IP address, encrypts all transmitted data, and allows them to access private network resources as if they were physically connected.

Encryption transforms readable data into a coded format. Symmetric encryption uses a single key for both encryption and decryption (fast but risky key exchange). Asymmetric encryption uses a public key to encrypt and a private key to decrypt, ensuring secure communication without sharing the secret key.

Encryption is a two-way process used to hide data so it can be decrypted later. Hashing is a one-way mathematical function that generates a fixed-length signature (hash) of the data. Hashing is used to verify data integrity (like passwords) because it cannot be reversed to find the original data.

An SSL (Secure Sockets Layer) certificate is a digital file that authenticates a website's identity and enables an encrypted connection. It uses public-key cryptography to ensure that data passed between the web server and browser remains private and integral, marked by the 'HTTPS' prefix in URLs.

A Denial of Service (DoS) attack aims to shut down a machine or network by flooding it with traffic from a single source. A Distributed Denial of Service (DDoS) attack uses a massive network of compromised computers (botnets) to flood the target from many different sources simultaneously.

A DoS attack comes from one location and is relatively easy to block. A DDoS attack is much more powerful and difficult to stop because it originates from thousands of different IP addresses globally, making it hard to distinguish legitimate traffic from the attack traffic.

Prevention includes using specialized DDoS mitigation services (like Cloudflare), implementing rate limiting on servers, using firewalls to filter suspicious traffic patterns, and ensuring the network has enough redundant bandwidth to absorb sudden spikes in traffic during an attack.

An MITM attack occurs when an attacker secretly intercepts and potentially alters communication between two parties who believe they are talking directly to each other. Attackers often use techniques like ARP spoofing or fake Wi-Fi hotspots to sit in the middle of the data stream.

DNS Spoofing (or cache poisoning) is an attack where an attacker alters DNS records to redirect users to a malicious website. When a user types a legitimate URL, the corrupted DNS server provides the IP of the attacker's fake site, often used for phishing and stealing credentials.

Phishing is a social engineering attack where attackers send deceptive messages (emails or texts) that appear to be from a reputable source. The goal is to trick the recipient into revealing sensitive information, such as passwords or credit card numbers, or installing malware on their device.

A virus attaches to a host file and needs user action to spread. A worm is a standalone program that replicates and spreads automatically over a network. A Trojan is malware disguised as useful software that requires a user to install it before it can cause damage.

SQL Injection (SQLi) is a vulnerability where an attacker inserts malicious SQL code into a query through a web application input. This can allow the attacker to view private data, modify or delete database records, and in some cases, gain full administrative access to the server.

A brute force attack is a trial-and-error method used to guess passwords or encryption keys. Attackers use automated software to rapidly try every possible combination of characters until they find the correct one. This can be prevented using strong passwords and account lockout policies.

The data is encapsulated into segments (Transport), then into packets with IP addresses (Network), and finally into frames (Data Link). Routers check the destination IP and forward the packet across multiple hops until it reaches the destination MAC, where it is decapsulated back into the original data.

The browser performs a DNS lookup to find Google's IP, establishes a TCP 3-way handshake, and optionally a TLS handshake for HTTPS. It then sends an HTTP GET request, the server responds with the webpage data (HTML/CSS), and the browser renders it for the user.

A load balancer distributes network traffic across a group of backend servers to prevent overload. Common algorithms include Round Robin (rotational), Least Connections (send to least busy server), and IP Hash (uses client IP to determine the server), ensuring high availability and performance.

A load balancer focuses on distributing traffic to multiple servers for performance. A reverse proxy sits in front of one or more web servers to handle tasks like SSL termination, caching, and protecting the server's identity, though many modern devices perform both roles simultaneously.

A CDN is a geographically distributed network of proxy servers and data centers. It stores (caches) copies of a website's static content (like images and videos) near the user's location, which significantly reduces latency, improves page load speeds, and decreases server bandwidth costs.

Vertical scaling (scaling up) involves adding more power (CPU, RAM) to an existing server. Horizontal scaling (scaling out) involves adding more servers to your network pool. Horizontal scaling is generally preferred for high availability as it prevents a single point of failure.

Caching is the process of storing copies of data in a temporary storage location so that future requests can be served faster. Types include Browser Caching (on user PC), CDN Caching (edge servers), Database Caching (RAM), and Application Caching (storing expensive computation results).

Ping tests reachability and latency to an IP using ICMP. Traceroute shows the exact path (hops) a packet takes to reach a destination. Netstat displays active network connections, routing tables, and interface statistics, helping administrators monitor and troubleshoot local network activity.

Unicast is one-to-one communication between a single sender and receiver. Broadcast is one-to-all communication where every device on a subnet receives the data. Multicast is one-to-many communication where data is sent only to a specific group of interested devices.

A LAN (Local Area Network) covers a small area like an office or home. A MAN (Metropolitan Area Network) covers a city or a large campus. A WAN (Wide Area Network) covers vast distances, such as countries or continents, often using leased telecommunication lines like the internet.