LI Interview questions and answers on networking

1. What is the difference between ifconfig and ip commands?

Answer:

• ifconfig:

o Deprecated tool for managing network interfaces.

o Limited functionality compared to modern tools.

• ip (from the iproute2 package):

o More powerful and flexible.

o Unified interface for managing IP addresses, routes, and interfaces.

o Example : run the below commands in terminal

ip addr show

ip link set eth0 up

ip route add default via 192.168.1.1

2.What are namespaces in Linux, and how do they relate to networking?

Answer:

• Namespaces are a feature of the Linux kernel that isolate resources such as processes,
network interfaces, and mounts.

• Network namespaces:

o Allow separate virtual network stacks for isolated environments.

o Each namespace has its own interfaces, routing tables, and ARP tables.

o Tools like ip netns can manage network namespaces.

3.Explain the differences between a bridge, a switch, and a router.

Answer:

• Bridge: Operates at Layer 2 (Data Link Layer); connects two network segments and forwards
packets based on MAC addresses.

• Switch: Similar to a bridge but more advanced, handling multiple ports and faster
forwarding.
 • Router: Operates at Layer 3 (Network Layer); routes packets between different networks
using IP addresses.

Linux supports bridging with tools like brctl and routing with tools like ip route.

4. How does ARP (Address Resolution Protocol) work in Linux?

Answer:

• ARP is used to map IP addresses to MAC addresses within a local network.

• Workflow:

1. The host sends a broadcast ARP request (who has <IP address>?).

2. The device with the requested IP responds with its MAC address.

• The ARP table stores mappings, which can be viewed or modified using:

o arp (deprecated)

o ip neigh (modern command)

5.How do you debug network issues on a Linux system?

Answer:

• Common tools for debugging network issues:

o ping: Test connectivity to a host.

o traceroute: Trace the route packets take to the destination.

o netstat / ss: View active connections and open ports.

o tcpdump: Capture and analyze packets.

o ethtool: Check and configure network interfaces.

o dmesg: Check kernel logs for hardware or driver issues.

6. Explain the Linux kernel's implementation of the socket API.

Answer:

• The socket API is an abstraction that provides access to network communication.

• In Linux:

1. A socket is represented by a struct socket in the kernel.

2. Each socket is linked to a protocol family (e.g., PF_INET for IPv4, PF_INET6 for IPv6).
 3. Data flow between user space and kernel space occurs via system calls like
socket(), bind(), listen(), accept(), send(), and recv().

7. What are the differences between TCP and UDP? How does Linux manage them?

Answer:

• TCP (Transmission Control Protocol):

o Connection-oriented

o Reliable data transfer with acknowledgment

o Error-checking and retransmissions

o Example: HTTP, FTP, SSH

• UDP (User Datagram Protocol):

o Connectionless

o Best-effort delivery (no retransmission)

o Faster but less reliable

o Example: DNS, video streaming, VoIP

• Linux manages TCP and UDP using different protocol control blocks:

o TCP uses Transmission Control Block (TCB) for managing connections.

o UDP simply places packets in a receive queue without maintaining state.

8.How does Linux implement IP routing?

Answer:

• The Linux kernel uses the routing table to determine the next hop for a packet.

• Routing decisions are made based on:

o Destination IP address

o Subnet mask

o Gateway

o Interface

• The routing table can be viewed using the ip route or route command.

• Linux supports both static routing and dynamic routing through tools like Quagga or BIRD
1. What is TCP/IP and how does it work?
TCP/IP stands for Transmission Control Protocol/Internet Protocol. It is a suite of communication
protocols used to interconnect network devices on the internet. TCP handles reliable data
transmission between devices, guaranteeing data delivery and maintaining the order of packets,
while IP handles addressing and routing of data packets across networks.

2. What is the difference between TCP and UDP?

TCP (Transmission Control Protocol) is connection-oriented, reliable, and guarantees packet
delivery in order, while UDP (User Datagram Protocol) is connectionless, unreliable, and faster but
without delivery guarantees. TCP is used for applications like HTTP and FTP, while UDP is used for
applications like DNS and VoIP.

3. How does TCP ensure reliable data transmission?

TCP ensures reliable data transmission through a three-way handshake (SYN, SYN-ACK, ACK),
acknowledgments, sequencing of packets, retransmission of lost packets, and flow control
mechanisms like sliding windows.

4. What is the purpose of the TCP/IP handshake?

The three-way handshake establishes a reliable connection between the sender and receiver. It
consists of three steps: SYN (synchronize), SYN-ACK (synchronize-acknowledge), and ACK
(acknowledge) to ensure both devices are ready for communication.

5. What is a TCP segment and what does it contain?

A TCP segment is a unit of data transmitted over a TCP connection. It consists of a header with
control information (source/destination ports, sequence numbers, acknowledgment numbers,
flags) and the data (payload) being transferred.

6. What is a UDP datagram and what does it contain?

A UDP datagram consists of a header that includes the source port, destination port, length of data,
and checksum, followed by the actual data (message) being transferred. UDP is simpler than TCP
as it doesn't guarantee delivery or order of packets.
7. Explain the differences between the IP addressing classes (Class A, B,
C, etc.).
IP addresses are divided into classes for routing purposes:
Class A: 1.0.0.0 to 127.255.255.255, used for large networks.
Class B: 128.0.0.0 to 191.255.255.255, used for medium-sized networks.
Class C: 192.0.0.0 to 223.255.255.255, used for smaller networks.
Class D: 224.0.0.0 to 239.255.255.255, used for multicast.
Class E: 240.0.0.0 to 255.255.255.255, reserved for experimental use.

8. How does NAT (Network Address Translation) work in IP networks?

NAT translates private IP addresses to a public IP address and vice versa. It allows devices within a
private network to communicate with the internet by mapping private IPs to a public IP, and
maintaining a translation table to track the connections.

9. What is the TCP window size, and how does it affect throughput?
The TCP window size specifies the amount of data that can be sent before receiving an
acknowledgment. A larger window size allows more data to be sent, increasing throughput, while a
smaller window size reduces throughput due to frequent waiting for acknowledgments.

10. What is the difference between IPv4 and IPv6?

IPv4 uses a 32-bit addressing scheme, allowing for about 4.3 billion addresses. IPv6 uses a 128-bit
addressing scheme, which supports vastly more addresses. IPv6 is written in hexadecimal notation
and is designed to solve IPv4 address exhaustion and improve network security.

11. Explain the process of TCP connection termination.

TCP connection termination occurs in a four-way handshake: 1. The sender sends a FIN segment.
2. The receiver acknowledges with an ACK. 3. The receiver sends its own FIN. 4. The sender
acknowledges the receiver's FIN, and the connection is closed
Preparation Tips:

1. Hands-on Practice: Use tools like netstat, and ip to understand their outputs.

2. Code Networking Programs: Practice socket programming in C/C++ to understand how

Linux handles networking internally.

3. Read Kernel Source Code: Familiarize yourself with key files related to networking in the
Linux kernel source (e.g., /net/ipv4/).