TCP IP DNS — Cheat Sheet

Tags: networking, tcp, ip, dns, http, protocols

Level: intermediate

TL;DR: Reference on transport mechanisms, IP addressing, DNS resolution chain, and connection lifecycle for technical interviews.

Key concepts

TCP provides connection-oriented, reliable, ordered, and error-checked delivery via sequence numbers and ACKs.

UDP provides connectionless, lightweight datagram delivery without retransmission, ordering, or congestion control.

TCP 3-way handshake establishes state: SYN, SYN-ACK, ACK.

TCP 4-way handshake terminates state: FIN, ACK, FIN, ACK, leaving the initiator in TIME_WAIT.

TIME_WAIT lasts 2 MSL to ensure delayed packets expire and the final ACK is received.

Flow control prevents receiver buffer overflow using sliding window advertisements (TCP Window).

Congestion control protects network capacity via Slow Start, Congestion Avoidance, Fast Retransmit, and Fast Recovery.

IP routes packets across network boundaries using IP addresses and routing tables (hop-by-hop).

DNS maps human-readable domain names to IP addresses hierarchically: Root, TLD, and Authoritative servers.

Recursive DNS resolvers query the DNS hierarchy on behalf of clients and cache responses according to TTL.

Typical questions and ready answers

Q: What happens under the hood when a client opens a TCP connection?R: I see the client send a SYN packet with an initial sequence number, the server reply with SYN-ACK, and the client conclude with ACK.

Q: Why does TCP close with four packets instead of three?R: Each endpoint must terminate its half of the duplex stream independently with a FIN-ACK pair, as one side may still send data.

Q: Why does the TIME_WAIT state exist, and why is it problematic at high scale?R: It ensures the remote host received the final ACK and absorbs lingering packets; high connection turnover can exhaust available local ports.

Q: How does a DNS recursive resolution work from scratch?R: The resolver checks local cache, then queries root nameservers, traverses the specific TLD servers, and fetches records from the authoritative server.

Q: What is the difference between TCP flow control and congestion control?R: Flow control matches sender speed to receiver buffer capacity, while congestion control limits traffic to prevent saturating intermediate network links.

Q: What triggers a DNS fallback from UDP to TCP?R: When response payloads exceed 512 bytes (or EDNS buffer sizes) and the truncation flag TC is set, or during zone transfers.

Pitfalls and common mistakes

Assuming UDP packets cannot be filtered or intercepted because UDP lacks handshakes.

Forgetting that DNS records have TTL values, causing prolonged propagation delays or stale routing during migrations.

Misinterpreting high TIME_WAIT socket counts as memory leaks instead of normal short-lived TCP connection churn.

Ignoring TCP head-of-line blocking when designing multiplexed application protocols over a single TCP stream.

Confusing authoritative DNS servers with recursive resolver caches.

Snippets and commands

# Trace full DNS resolution hierarchy
dig +trace example.com

# Query specific DNS record type with clean output
dig +short A example.com
dig +short AAAA example.com
dig +short CNAME sub.example.com

# Inspect TCP connection states and port counters
ss -tan state time-wait
netstat -ant | awk '{print $6}' | sort | uniq -c

# Trace network route hop-by-hop
traceroute -T -p 443 example.com

# Capture TCP handshake packets on specific interface
tcpdump -nn -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'

To review

[ ] Understand sliding window math and TCP window scale options.

[ ] Review differences between IPv4 subnetting and IPv6 prefix addressing.

[ ] Inspect common DNS record types: A, AAAA, CNAME, MX, TXT, NS, and SRV.

[ ] Master TCP state machine transitions: CLOSE_WAIT vs TIME_WAIT.

[ ] Review how QUIC (HTTP/3) uses UDP to resolve TCP head-of-line blocking.