Computer Networks Interview Questions: Trace OSI, TCP/IP and Routing Step by Step

A memorised seven-layer list often fails when the next question is, ‘What actually changes as my request crosses a router?’ Start with one synthetic request: typing https://study.example/notes leads to DNS resolution, a first-hop frame, a TCP connection, IP forwarding and the response. Reusing the same addresses and sequence numbers keeps every interview answer connected to the packet’s path.

OSI and TCP/IP: build one usable map

The OSI stack runs from Application, Presentation, Session, Transport, Network and Data Link down to Physical. In the common four-layer TCP/IP model, the top three sit within Application, Transport maps to Transport, Network to Internet, and Data Link plus Physical to Link. Some teaching models split Physical into a fifth layer. Explain the mapping instead of claiming that only one layer count is valid.

Moving down the stack, application data becomes a TCP segment or UDP datagram, an IPv4 packet, an Ethernet frame and transmitted bits. Identifiers also change scope: a host name at Application, ports at Transport, IP addresses at Internet, and MAC addresses on one local link.

For a 25-second answer, state each layer’s purpose, identifier or header, reader, and hand-off. Hosts process the full stack, routers inspect IP packets, and switches inspect link frames. Do not call every unit a “packet” when encapsulation is being tested.

With no TCP or IPv4 options, 480 + 20 = 500 bytes, 500 + 20 = 520, and 520 + 14 + 4 = 538 in the Ethernet frame. This excludes the preamble and inter-packet gap.

DNS, subnetting and ARP: resolve the name and first hop

Use this topology: laptop 192.168.10.25/24 with MAC 02:00:00:00:10:25; DNS resolver 192.168.10.53; gateway 192.168.10.1 with MAC 02:00:00:00:10:01; server 203.0.113.10.

In one simplified path, a DNS query goes from client UDP port 53000 to resolver port 53; the reply carries study.example -> 203.0.113.10. DNS does not always use UDP, and caching can avoid a fresh lookup. The Application Layer Protocols: DNS and HTTP Guide explains resolution and request timing in depth. Once the resolver returns 203.0.113.10, the next decision is whether that address is on the laptop’s local subnet.

Apply the mask: 192.168.10.25 AND 255.255.255.0 = 192.168.10.0, while 203.0.113.10 AND 255.255.255.0 = 203.0.113.0. The networks differ, so the laptop addresses the Ethernet frame to its gateway, not the remote server’s MAC.

On a cache miss, the laptop broadcasts an ARP request for 192.168.10.1; the gateway replies with 02:00:00:00:10:01. The frame uses that destination MAC, while its IP destination remains 203.0.113.10. A switch uses its MAC table; the router removes the local frame and inspects the IP destination.

TCP handshake, sequence numbers and application bytes

From the laptop’s view, the connection is 192.168.10.25:51514 -> 203.0.113.10:443. The client sends SYN seq=1000. The server replies SYN-ACK seq=7000 ack=1001, and the client completes the handshake with ACK seq=1001 ack=7001. Each SYN consumes one sequence number. The exchange synchronises both starting sequence numbers and confirms reachability in both directions.

After the secure application setup, suppose exactly 480 bytes of application and TLS data are handed to TCP. The first byte has sequence number 1001. The last is 1001 + 480 - 1 = 1480, so the next expected byte is 1481 and the server can reply ack=1481. TCP numbers bytes, not packets. If data is lost, TCP can retransmit it; the receiver window controls how much unacknowledged data the receiver can accept, while congestion control limits the sender according to network conditions.

TCP provides an ordered byte stream, not application message boundaries, and it cannot guarantee that the application itself succeeds. UDP has no three-way handshake or TCP-style reliability machinery. An application may choose UDP for lower protocol overhead, latency needs or application-controlled recovery, but neither transport is universally faster or better. The TCP vs UDP: Transport Layer Explained guide owns the wider service-model and header comparison. For this request, TCP’s byte stream matters because the acknowledgement advances to 1481.

Routing, NAT and the fields each hop changes

At the edge, suppose NAT creates the mapping 192.168.10.25:51514 -> 198.51.100.25:40001. It changes the source IPv4 address, source port and affected IPv4 and transport checksums. On the return path, the NAT table reverses that mapping. NAT is separate from ordinary routing, which chooses a next hop from the destination address.

Router R1 has these routes:

Destination 203.0.113.10 matches all three. The /24 has the longest matching prefix, so R1 selects 10.0.0.2. Routing protocols may populate the table, but longest-prefix matching is the separate forwarding decision made for this packet.

R1 receives a frame addressed to its interface and removes that link header. It decrements IPv4 TTL from 64 to 63, updates the IPv4 header checksum, selects the next hop, and builds a new link-layer frame for the outgoing link. After NAT, the public source 198.51.100.25 and destination 203.0.113.10 remain logically end to end across ordinary routers. Link-layer addresses change at every routed hop.

Computer Networks interview questions from the trace

Use exact values so each answer stays connected to the trace.

For troubleshooting, test whether the name resolves, addressing and gateway are correct, ARP resolves the gateway, a route exists, TCP connects, and the application responds. This is a diagnostic sequence, not one universal root cause or employer script.

Common traps that make memorised answers collapse

• OSI and TCP/IP are not a perfect one-to-one layer map.

• DNS resolves names; it does not find the route for a packet.

• ARP works on the local link; it does not discover a remote server’s MAC.

• A switch primarily forwards frames, while a router forwards IP packets.

• NAT is not required for IP routing.

• TCP reliability means detection and recovery within TCP’s contract, or a reported failure. It does not mean the network has zero loss.

Check values as carefully as definitions. Port 51514 identifies the client transport endpoint, not a process on every router. Destination IP 203.0.113.10 does not become the gateway IP. ack=1481 means the next expected byte, not 1,481 packets. The /24 route beats the default.

For a closed-book drill, redraw the trace with client 192.168.20.25/24 and explain why its gateway must be on the 192.168.20.0/24 subnet.

The short version and the next practice step

DNS turns the name into 203.0.113.10. The /24 test sends that off-link destination to the gateway’s MAC. TCP creates the 51514 -> 443 byte stream. Routers choose next hops by longest prefix and rebuild link frames. The reply reverses the transport conversation and NAT mapping. Answer once in 60 seconds, then in five minutes with every header.

Use CS Fundamentals for Placements by Sanchit Sir for structured core CS revision. Use the Interview & Resume Preparation Course for broader technical and HR practice, then choose a topic-specific drill from the Resume & Interview Preparation category.