The interviewer asks, "What happens when you type a URL and press Enter?" You say the browser sends a request and the server sends back the page. They wait. "Before that. How does it find the server? What carries the bytes? Who encrypts them?" You know the words DNS, TCP and HTTPS. Putting them in order, and saying what each does, is what gets tested.
The short answer
Computer networks interview questions for freshers and backend roles come from a small pool: the OSI and TCP/IP models, MAC and IP addressing, subnetting, ARP, DHCP, NAT, routing, TCP and UDP, DNS, HTTP and TLS, and the infrastructure in front of every web app. Interviewers want the reason behind each mechanism, because that is what lets you debug a slow or broken connection. Below are 25 computer networks interview questions and answers, each with the follow-up you are likely to hear next.
Models and layers
1. What are the seven layers of the OSI model?
From the bottom: Physical (bits on a wire or radio), Data Link (frames between neighbours, MAC addresses), Network (packets across networks, IP, routing), Transport (delivery between processes, TCP and UDP), Session (managing a dialogue), Presentation (encoding, encryption) and Application (what the program speaks, such as HTTP).
2. How is the TCP/IP model different from OSI?
TCP/IP is what the internet runs, with four layers: Link, Internet, Transport and Application. OSI's top three collapse into Application, because real protocols do not split along those lines. OSI is a reference model for discussion; TCP/IP is the implemented stack.
Likely follow-up: "Which layer is TLS?" It sits above TCP and below HTTP and does not map cleanly onto OSI; saying it straddles session and presentation is the honest answer.
The local network
3. What is a MAC address, and how does it differ from an IP address?
A MAC address is a 48-bit address on a network interface, such as 3c:22:fb:1a:09:7e; the first 24 bits traditionally identify the manufacturer. It only matters on the local link. An IP address is logical, assigned by the network, and identifies a host across networks. As a packet crosses routers, the MAC addresses change at every hop while the IP addresses stay the same, unless NAT rewrites them.
4. What is the difference between a hub, a switch and a router?
A hub is a layer 1 repeater: every bit is copied out of every port, so all devices share one collision domain. A switch learns which MAC address sits behind which port and forwards each frame only there, flooding only broadcasts and frames for addresses it has not learned yet. A router connects different IP networks using a routing table and does not forward broadcasts, so it separates broadcast domains.
5. What does ARP do?
ARP maps an IP address to a MAC address on the local network. The host broadcasts "who has 192.168.1.20?", the owner replies by unicast, and the answer is cached. For a destination on another network, the host ARPs for its default gateway instead, because the frame only has to reach the router.
Likely follow-up: "What is ARP spoofing?" ARP has no authentication, so an attacker can claim to be the gateway and intercept traffic. IPv6 replaces ARP with Neighbor Discovery.
IP addressing and routing
6. Explain subnetting and CIDR.
An IPv4 address is 32 bits, split into network and host parts. CIDR writes the split as a prefix length: 192.168.1.0/26 leaves 6 host bits, so 64 addresses. The first (.0) is the network address and the last (.63) the broadcast, so 62 are usable; the next subnet starts at .64. Private ranges are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.
Likely follow-up: "How does a host know a destination is local?" It applies the subnet mask to both addresses; if the network parts match it delivers directly, otherwise it sends to the gateway.
7. What are the differences between IPv4 and IPv6?
IPv6 addresses are 128 bits, ending the shortage that made NAT necessary. IPv6 has no broadcast (it uses multicast), a fixed 40-byte base header with optional extension headers, and only the sender fragments, never routers.
8. How does DHCP assign an IP address?
Four messages, remembered as DORA. The client, with no address yet, broadcasts a Discover. A server replies with an Offer. The client broadcasts a Request for it and the server confirms with an Ack. The lease carries the subnet mask, gateway and DNS servers and expires unless renewed. DHCP runs over UDP ports 67 and 68.
Likely follow-up: "Broadcasts do not cross routers, so how does DHCP work across subnets?" A relay agent on the router forwards the request to the server.
9. What is NAT, and why is it used?
NAT lets many devices with private addresses share one public address. When your laptop at 192.168.1.5:51000 connects out, the router rewrites the source to its public IP and a port it picks, and records the mapping to translate replies back. This port-based form is PAT. It conserved IPv4 addresses.
Likely follow-up: "Is NAT a firewall?" No. It drops unsolicited inbound traffic as a side effect, not by policy.
10. Static vs dynamic routing, and distance vector vs link state?
Static routes are configured by hand: predictable, but they do not adapt to a failed link. Dynamic protocols discover paths and react. In distance vector protocols such as RIP, routers share distance tables with neighbours (Bellman-Ford): simple, but slow to converge and prone to count-to-infinity. In link state protocols such as OSPF, every router floods the state of its own links, builds a full map and runs Dijkstra itself, converging faster at the cost of memory and CPU.
Transport layer
11. What is the difference between TCP and UDP?
TCP is connection-oriented: a reliable, ordered byte stream with acknowledgements, retransmission, flow control and congestion control. UDP sends independent datagrams with no connection, delivery guarantee or ordering, and an 8-byte header. Use TCP when every byte must arrive in order: web pages, APIs, file transfer. Use UDP when a late packet is worthless or the application wants its own control: DNS lookups, live video, games and QUIC.
Likely follow-up: "TCP is a byte stream. What does that mean for your code?" One send can arrive as several reads, or two as one, so the application must frame its own messages.
12. Explain the TCP three-way handshake.
The client sends SYN with its initial sequence number. The server replies SYN-ACK with its own number and an acknowledgement of the client's. The client sends ACK. Both sides now know the other is reachable and have agreed on starting sequence numbers. It costs a round trip before any request, which is why connections are reused.
Likely follow-up: "What is a SYN flood?" Many SYNs that never complete, filling the server's queue of half-open connections. SYN cookies defend against it.
13. How is a TCP connection closed, and what is TIME_WAIT?
Each direction closes separately: one side sends FIN, the other ACKs, later sends its own FIN, and the first ACKs that, usually four segments. The side that closed first then waits in TIME_WAIT for twice the maximum segment lifetime, so its last ACK can be resent if lost and stray old packets cannot be mistaken for a new connection on the same ports.
14. What is the difference between flow control and congestion control?
Flow control protects the receiver: it advertises a receive window, how much more it can buffer, and the sender never has more unacknowledged data in flight. Congestion control protects the network: the sender keeps a congestion window estimating the path's capacity. Classic TCP starts with slow start, roughly doubling the window each round trip, then grows it slowly and cuts it when loss signals congestion. The data in flight is limited by the smaller of the two windows.
15. What are ports and sockets?
A port is a 16-bit number identifying an endpoint on a host. A socket is the operating system's handle for an endpoint: IP, port and protocol. A TCP connection is identified by source IP, source port, destination IP and destination port, which is how one server on port 443 holds thousands of connections: each client brings a different address or ephemeral port.
Application layer
16. How does DNS resolution work, step by step?
The browser and operating system check their caches. On a miss, the stub resolver asks a recursive resolver, usually your ISP's or a public one. If it has nothing cached, it asks a root server, which refers it to the .com servers, which refer it to the domain's authoritative name servers, which return the record, such as an A record. The resolver caches each answer for its TTL. DNS mostly uses UDP port 53, with TCP for large responses.
Likely follow-up: "You changed a record and some users still reach the old server. Why?" Cached copies live until their TTL expires. Lower the TTL well before a migration.
17. HTTP vs HTTPS: how does the TLS handshake work?
HTTPS is HTTP inside TLS, which adds encryption, integrity and server authentication. At a high level: the client lists the versions and ciphers it supports and sends key-exchange material; the server picks parameters and returns its key share and certificate. The client checks that the certificate matches the hostname and chains to a trusted certificate authority. Both sides derive the same symmetric keys, usually by ephemeral Diffie-Hellman. TLS 1.3 needs one round trip; TLS 1.2 needed two.
Likely follow-up: "Why not encrypt everything with the server's public key?" Asymmetric encryption is far slower, and ephemeral keys give forward secrecy: a stolen server key cannot decrypt recorded past sessions.
18. What changed from HTTP/1.1 to HTTP/2 to HTTP/3?
HTTP/1.1 is text with persistent connections, but each connection carries one response at a time, so browsers open several. HTTP/2 uses binary framing and multiplexes many streams over one TCP connection, with header compression. But one lost TCP packet stalls every stream until it is retransmitted: head-of-line blocking at the transport layer. HTTP/3 runs over QUIC, on UDP, with TLS 1.3 built in; streams recover from loss independently, setup takes fewer round trips, and a connection can survive a switch from Wi-Fi to mobile data.
19. How do cookies and sessions work?
HTTP is stateless, so the server sends Set-Cookie and the browser returns the cookie on later requests. In a server-side session the cookie holds only a random id, and the data lives on the server, often in Redis. HttpOnly hides a cookie from JavaScript, Secure restricts it to HTTPS, and SameSite limits cross-site sending, which helps against CSRF.
Likely follow-up: "Sessions in memory, and you add a second server?" Users are logged out at random. Use a shared store or sticky sessions.
Security and infrastructure
20. What is a firewall, and what kinds are there?
A firewall allows or blocks traffic by rules. A stateless packet filter judges each packet alone by address, port and protocol. A stateful firewall tracks connections, so replies to outbound traffic pass and unsolicited inbound packets drop. A web application firewall inspects HTTP itself and can block patterns such as SQL injection.
21. What is a VPN?
A VPN builds an encrypted tunnel across an untrusted network, so traffic inside it is unreadable on the path. Common protocols are IPsec, OpenVPN and WireGuard. A VPN moves trust to its operator; it does not make you anonymous.
22. What does a load balancer do? Layer 4 vs layer 7?
It spreads requests across servers and runs health checks, dropping servers that fail them, so you can scale out and survive a crash. A layer 4 balancer routes by IP and port without reading content: fast and protocol-agnostic. A layer 7 balancer understands HTTP, so it can route by path or header, terminate TLS and add X-Forwarded-For. It is a staple of system design interviews.
23. What is a CDN, and how does it make a site faster?
A content delivery network caches your content on servers near users. A user in Chennai is routed, by DNS or anycast, to a nearby edge rather than a distant origin, shortening the round trip for everything the edge can serve from its cache. Cache-Control headers decide what the edge keeps and for how long. The hard part is invalidation, which is why static files get content hashes in their names.
24. What is the difference between latency, bandwidth and throughput?
Latency is how long data takes to arrive, often measured as round-trip time. Bandwidth is the link's maximum capacity. Throughput is what you actually get, limited by the slowest link, packet loss, TCP's windows and round-trip time. A page of many small files is dominated by latency, so fewer round trips (reused connections, HTTP/2, a CDN) help more than a faster plan.
The end-to-end question
25. What happens when you type a URL and press Enter?
Tell it in order. The browser parses the URL and checks its cache. DNS resolves the hostname (question 16). The OS sees the IP is not local, ARPs for the gateway's MAC and sends the packet to the router (questions 5 and 6). NAT rewrites the source address (9) and routers forward hop by hop (10). A TCP handshake opens a connection to port 443 (12), or QUIC over UDP for HTTP/3, and TLS verifies the certificate and agrees keys (17). The browser sends GET /path with headers and cookies (19). A CDN edge may answer from cache, or a load balancer picks an application server, which may query a database and returns HTML. The browser parses it, fetches CSS, JavaScript and images, and renders.
Likely follow-up: the interviewer picks one step and digs, such as "How does a server know which site you want on a shared IP?" The Host header, and SNI in the TLS handshake before it.
How to practise these
Run the commands behind the answers: dig or nslookup for DNS, traceroute (tracert on Windows) for hops, curl -v for the TLS handshake and headers and the browser's network tab for timings. Then say question 25 out loud in under three minutes. When an interviewer pushes past what you know, read how to handle a question you don't know. Networking usually sits beside DBMS and OOPs in a core subjects round, so pair this with the DBMS interview questions and the fresher interview preparation guide.
To rehearse out loud, a backend practice round on 99interview with Sia, our AI interviewer, asks one question at a time against a clock and follows up on what you said; you speak or type each answer, and each is scored with a written write-up. A live Zoom interview with a working engineer is rated on technical depth, problem solving, communication, behaviour and code quality, with written feedback.