What you'll learn

  1. Quick answer
  2. OSI vs TCP/IP, and the follow-up question
  3. The protocol questions that come up every time
  4. Switch, router and NAT: the device questions
  5. Subnetting you can do without a calculator
  6. Rapid-fire answers worth memorising
  7. FAQ

Quick Answer

Computer networks rounds in Indian placements stay close to a fixed set: OSI versus TCP/IP, TCP versus UDP, how DNS and ARP resolve addresses, the difference between a switch and a router, NAT, and basic subnetting. Interviewers rarely want definitions. They want the follow-up: which layer a device works at, what reliable means at packet level, and how many usable hosts a /26 gives you. Answer the mechanism, not the textbook line.

OSI vs TCP/IP, and the follow-up question

Almost every candidate can recite the seven OSI layers. Far fewer survive the next question, which is usually some version of which layer does this thing work at, and how do you know?

Start with the honest framing, because interviewers like it. OSI is a reference model with seven layers and it was never shipped as a product. What actually runs on every machine you will touch is the TCP/IP stack, usually described as four layers: link, internet, transport, application. Several Indian university syllabi teach a five-layer version that splits physical from data link. Say which model you are using before you answer, and the ambiguity stops being a trap.

OSI                TCP/IP         Examples
7 Application      Application    HTTP, DNS, SMTP
6 Presentation     Application    encoding, compression
5 Session          Application    (no separate implementation)
4 Transport        Transport      TCP, UDP
3 Network          Internet       IP, ICMP
2 Data link        Link           Ethernet, Wi-Fi, ARP
1 Physical         Link           cable, radio, optics

The follow-up that catches people is TLS. There is no clean OSI slot for it. The defensible answer is that TLS runs on top of TCP and underneath HTTP, so it behaves like a presentation-layer service implemented as a shim above the transport layer. Explain the ordering and no interviewer will argue about the number.

The second follow-up is load balancers, and it is asked constantly. A layer 4 balancer forwards connections using only source and destination IP and port. It never reads the payload, so it cannot see the URL or the Host header. A layer 7 balancer terminates the connection, parses the HTTP request, and can send /api to one pool and /blog to another. That single difference explains why TLS termination usually happens at layer 7 and why layer 4 is cheaper.

The protocol questions that come up every time

Six protocols cover most of what a fresher is asked. Learn what each one is responsible for and, more importantly, what it deliberately does not do.

IP is best effort. It gets a packet towards a destination and makes no promise it arrives, arrives once, or arrives in order. Every guarantee you associate with the internet is built on top of that. TCP adds ordering and retransmission. UDP adds almost nothing beyond ports and a checksum, which is the point.

ARP is the one people forget. IP addressing is useless on a local network until the sender knows the destination MAC address. ARP broadcasts who has 192.168.1.1 and caches the reply. This is why two machines on the same subnet never involve the router: the switch forwards the frame directly once ARP has resolved.

DHCP hands out addresses using the DORA exchange: Discover, Offer, Request, Acknowledge. The first message is a broadcast because the client has no IP yet, which is also why DHCP runs over UDP and not TCP.

ICMP is the diagnostic protocol behind ping. Here is the gotcha worth stating out loud: a host that does not reply to ping is not necessarily down. Plenty of cloud firewalls drop ICMP by default while port 443 answers perfectly. Test the actual service port before declaring an outage.

traceroute is the classic explain-the-mechanism question. It sends packets with TTL 1, then 2, then 3. Each router that decrements the TTL to zero returns an ICMP Time Exceeded message, which reveals its address. The implementations differ by platform, and saying so scores points.

Windows:  tracert priodemy.com       sends ICMP echo requests
Linux:    traceroute priodemy.com    sends UDP datagrams by default
          traceroute -I priodemy.com use ICMP instead

arp -a         show the local IP to MAC cache (Windows; also Linux
               where the older net-tools package is installed)
ip neigh       the modern Linux equivalent of arp -a
ipconfig /all  Windows
ip addr        Linux

Switch, router and NAT: the device questions

The question is nearly always phrased as difference between a hub, a switch and a router, and the marks are in the layer.

A hub is layer 1. It repeats every incoming signal out of every other port, so all devices share bandwidth and collide. Nobody deploys them any more, but they are still on the syllabus.

A switch is layer 2. It learns which MAC address lives behind which port by watching source addresses on incoming frames, then forwards each frame only to the right port. Everything plugged into a switch sits in one broadcast domain, which is exactly why an ARP broadcast reaches all of them.

A router is layer 3. It forwards based on destination IP and a routing table, and it separates broadcast domains. Broadcasts do not cross a router, and that is the cleanest one-line answer to what is the difference between a switch and a router.

Then comes the practical catch. The box your ISP installed at home is not a router. It is a router, a switch, a wireless access point, a DHCP server and a NAT device in one plastic shell. Interviewers like candidates who notice this.

NAT explains why your laptop reports 192.168.1.7 while any what-is-my-IP site shows something completely different. Private addresses are not routable on the public internet, so the router rewrites the source address and port on the way out and reverses the translation on replies.

Private ranges (never routed on the public internet):
10.0.0.0/8        10.0.0.0    - 10.255.255.255
172.16.0.0/12     172.16.0.0  - 172.31.255.255
192.168.0.0/16    192.168.0.0 - 192.168.255.255

NAT also answers a question students hit while building projects: your Node server on port 3000 is reachable from your phone on the same Wi-Fi but not from a friend across the city, because there is no mapping for unsolicited inbound connections until you configure port forwarding or use a tunnel.

Subnetting you can do without a calculator

Subnetting questions are pure arithmetic and they are free marks once you learn one trick.

The prefix tells you how many bits are fixed. A /24 fixes 24 bits, leaving 8 host bits, so 2 to the power 8 equals 256 addresses. Two of those are reserved: the first is the network address and the last is the broadcast address. That leaves 254 usable hosts. Candidates who say 256 usable hosts lose the question immediately.

Prefix  Mask               Addresses  Usable hosts
/24     255.255.255.0      256        254
/25     255.255.255.128    128        126
/26     255.255.255.192    64         62
/27     255.255.255.224    32         30
/28     255.255.255.240    16         14
/30     255.255.255.252    4          2

The trick is block size. Take the interesting octet of the mask and subtract it from 256. For 255.255.255.192 the block size is 256 minus 192, which is 64. Subnets therefore start at .0, .64, .128 and .192.

Worked example. Given 192.168.10.100/26, which subnet is it in? Block size 64, so the boundaries are 0, 64, 128, 192. The address 100 falls between 64 and 127. Network address is 192.168.10.64, broadcast is 192.168.10.127, and the usable range is .65 to .126.

You can verify any of this in Python before an interview instead of trusting a memorised table.

import ipaddress

net = ipaddress.ip_network('192.168.10.100/26', strict=False)
print(net)                          # 192.168.10.64/26
print(net.network_address)          # 192.168.10.64
print(net.broadcast_address)        # 192.168.10.127
print(net.num_addresses)            # 64
print(sum(1 for _ in net.hosts()))  # 62

Note strict=False. Without it, Python raises ValueError: 192.168.10.100/26 has host bits set, because 192.168.10.100 is a host address, not a network address, which is a neat demonstration of the very distinction the question is testing. One exception worth a sentence: the minus-two rule does not apply to /31 links between routers, where both addresses are usable.

Rapid-fire answers worth memorising

These come as one-liners near the end of a round. Keep the answers short and mechanism-first.

  • Three-way handshake: client sends SYN with an initial sequence number, server replies SYN-ACK, client sends ACK. Only then can data flow, which costs one full round trip before the first byte.
  • Connection close: four messages, FIN and ACK in each direction, because each side closes its half independently. The closing side then sits in TIME_WAIT so late duplicate segments cannot be mistaken for a new connection.
  • Latency vs bandwidth: latency is how long one packet takes to arrive, bandwidth is how much can be in flight per second. A fibre link with high bandwidth can still feel slow if every request needs several round trips.
  • Why HTTP is stateless: the server keeps no memory between requests, so identity has to travel with each one, which is what cookies, sessions and tokens exist for.
  • MAC vs IP: a MAC address identifies an interface on a local link and does not change as the packet crosses the internet. The IP address identifies a host on a network and is what routers use. Source and destination MAC are rewritten at every hop, source and destination IP normally are not.
  • Forward vs reverse proxy: a forward proxy sits in front of clients and hides them from the server. A reverse proxy such as Nginx sits in front of servers and hides them from clients.
  • How can many clients use port 443 at once: a connection is identified by the five-tuple of protocol, source IP, source port, destination IP and destination port, so thousands of distinct sockets can share one server port.
Ports worth knowing cold
22   SSH        53   DNS        80   HTTP
443  HTTPS      25   SMTP       3306 MySQL
5432 PostgreSQL 27017 MongoDB   6379 Redis

Frequently Asked Questions

Do web and app developers really get asked networking questions? Yes, and usually harder ones than CS-core candidates get. If you claim backend or full stack experience, expect questions about DNS, HTTP over TCP, TLS, ports and why a service is unreachable. The framing is practical rather than theoretical: they want to know whether you can debug a deployment, not whether you memorised the syllabus.
How much subnetting should a fresher actually prepare? Enough to convert between prefix and dotted mask, find the network and broadcast address of any given host address, and count usable hosts. That covers almost every placement question. Full VLSM design and route summarisation are networking-specialist topics and rarely appear unless the role is explicitly network engineering.
Should I answer using the OSI model or the TCP/IP model? Answer with OSI vocabulary because that is what the question is written in, then add the one line that the running stack is TCP/IP with four layers. This shows you know the model is a teaching tool. It also protects you when the interviewer's own syllabus uses the five-layer variant.
What is the difference between latency, bandwidth and throughput? Latency is delay for a single packet, measured in milliseconds. Bandwidth is the theoretical capacity of the link. Throughput is what you actually achieve, which is always lower because of protocol overhead, retransmissions and congestion control ramping up. A common interview trap is treating bandwidth and throughput as the same word.
Is it worth memorising port numbers? The common ones, yes, because they appear in rapid-fire rounds and in real debugging. Knowing that 443 is HTTPS, 22 is SSH and 3306 is MySQL lets you read a firewall rule or a netstat output at a glance. There is no value in memorising obscure ones you will never configure.