Networking Basics — Cheat Sheet

Tags: networking, tcp, udp, dns, http, osi-model, ip, routing

Level: basic

TL;DR: Core computer networking models, protocols, troubleshooting commands, and common latency or connectivity pitfalls for technical interviews.

Key concepts

OSI model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application.

TCP/IP model condenses networking into 4 layers: Network Access, Internet, Transport, Application.

TCP provides connection-oriented, reliable, ordered byte streams via a three-way handshake (SYN, SYN-ACK, ACK).

UDP is connectionless, lightweight, and unordered, prioritizing low latency over reliability.

IP addresses identify hosts logically; MAC addresses identify network interfaces physically on a local segment.

ARP resolves IPv4 addresses to local hardware MAC addresses via Layer 2 broadcast.

DNS translates human-readable domain names into IP addresses through hierarchical recursive and authoritative resolvers.

NAT maps private local subnet IP addresses to one or more public IP addresses.

Subnet masks divide IP address space into network prefixes and host identifiers using CIDR notation.

Routing moves packets between different subnets using Layer 3 routing tables and gateways.

Typical questions and ready answers

Q: What is the fundamental difference between TCP and UDP?R: TCP guarantees delivery, ordering, and flow control through handshakes and acknowledgments, whereas UDP sends packets without handshakes or retries to minimize latency.

Q: What happens under the hood when you enter a URL into a browser?R: The browser resolves the IP via DNS, establishes a TCP connection (and TLS handshake for HTTPS), sends the HTTP request, and renders the received server response.

Q: What is the difference between a switch and a router?R: Switches operate at Layer 2 using MAC addresses to forward frames locally, while routers operate at Layer 3 using IP addresses to route packets between different networks.

Q: How does a TCP connection gracefully terminate?R: It uses a four-way handshake exchange of FIN and ACK segments initiated by one peer and acknowledged by the other.

Pitfalls and common mistakes

Assuming UDP is always faster without accounting for application-level packet loss recovery overhead.

Confusing HTTP keep-alive persistent connections with TCP-level keep-alive packets.

Forgetting that DNS records can be cached at multiple levels: browser, OS, local resolver, and ISP.

Neglecting subnet mask boundaries when diagnosing IP reachability inside local subnets.

Overlooking MTU limits, which cause unexpected packet fragmentation or dropped packets across VPN tunnels.

Snippets and commands

# Check reachability and round-trip time to a remote host
ping -c 4 8.8.8.8

# Query DNS records for a domain directly against a specific resolver
dig @1.1.1.1 example.com A +short

# Trace layer-3 hops along the packet route
traceroute example.com

# Inspect active listening sockets and port bindings
ss -tulpn

# Display the local ARP resolution cache table
arp -an

# View IP address configuration and interface state
ip addr show

To review

[ ] Memorize the exact data unit names per OSI layer: frame, packet, segment.

[ ] Understand TCP congestion control mechanisms: slow start, congestion avoidance, fast retransmit.

[ ] Review IPv4 CIDR prefix calculation and private address ranges: RFC 1918.

[x] Three-way handshake sequence flags: SYN, SYN-ACK, ACK.

[x] Basic difference between public and private IP addressing.