| Claim / Question | Answer | Why |
|---|
| Architecture · Layering · Switching (midterm scope) |
| Which protocol is the "narrow waist"? (WiFi/BGP/HTTP/TCP/IP) | IP | The hourglass waist = the IP layer; everyone on the Internet must speak IP. TCP/HTTP above and link layers below are all replaceable — only IP is not. |
| What does layering directly provide? (Reliability / Modularity / Transfer Speed / Abstraction / Addressing) | Modularity + Abstraction | Layering gives modularity + abstraction. Reliability and addressing must be implemented inside some layer; transfer speed can actually get worse due to overhead. |
| End-to-End principle: the network (routers) must implement reliability to guarantee reliable delivery. | False | E2E: the end hosts alone are sufficient for reliability; routers may help but aren't required. Correctness of reliability ultimately rests on the two ends (TCP). |
| Core advantage of packet switching over circuit switching? | Stat. muxing | Statistical multiplexing: no reservations needed, efficient under bursty traffic. Cost: queueing delay, no bandwidth guarantee. Circuit is the opposite: guaranteed bandwidth but low utilization. |
| The IP layer provides reliable, in-order, guaranteed delivery. | False | IP is best-effort: packets may be dropped/reordered/duplicated; connectionless. Reliability is left to TCP. |
| Higher bandwidth reduces propagation delay. | False | propagation = distance/speed of light — independent of bandwidth. Bandwidth only affects transmission delay (= size/bandwidth). |
| Performance · Addressing · Forwarding (midterm scope) |
| A store-and-forward router must receive the entire packet before forwarding it. | True | So an N-hop end-to-end path accumulates one transmission delay per hop. Queueing delay is not fixed — it explodes with load. |
| How many addresses does a /n prefix contain? | 2^(32−n) | E.g. /24 → 256, /25 → 128, /32 → 1 (single host). |
| The result of Longest Prefix Match depends on the order of entries in the forwarding table. | False | LPM only looks at the "longest matching prefix," regardless of entry order. Longer prefix = more specific = wins; default route = 0.0.0.0/0. |
| Any two prefixes can be aggregated into one. | False | Only two adjacent and aligned /n prefixes can merge into one /(n−1) (otherwise you'd cover addresses you shouldn't). |
| IP Header · Fragmentation · Traceroute (midterm scope) |
| What is TTL for? What happens when it hits 0? | Loop prevention | −1 per hop; at 0 → drop + send back ICMP Time Exceeded. traceroute relies on this (probe hop by hop with TTL=1,2,3…; * = that hop doesn't reply). |
| The IP header checksum must be recomputed at every hop. | True | Because TTL changes every hop; and the checksum covers only the header, not the data. |
| After fragmentation, routers along the path reassemble. | False | Only the destination host reassembles. Offset is in units of 8 bytes; MF=1 means more fragments follow. |
| IPv6 routers can fragment packets. | False | IPv6 routers never fragment (the source handles it / PMTUD); IPv6 dropped the header checksum and has a fixed 40B header. |
| Intra-domain Routing DV / LS (midterm scope) |
| Link-State requires every node to know the entire network topology. | True | LS: flood link info network-wide → run Dijkstra locally. DV only exchanges distance vectors with neighbors. |
| count-to-infinity is a Link-State problem. | False | It's a Distance-Vector problem (distances slowly climb after a link failure). LS has a global view and doesn't suffer it. |
| poison reverse / split horizon eliminate all routing loops. | False | They only fix 2-node loops; loops of ≥3 nodes can still count to infinity. Hence the INFINITY cap (=16). |
| DV converges faster than LS. | False | DV converges slowly (hop-by-hop propagation); LS converges fast but flooding is expensive and needs more memory/compute. |
| BGP · Inter-domain (midterm scope) |
| BGP route-preference order? | C>Pe>Pr | customer > peer > provider (customer routes earn money, peer is free, provider costs money). |
| A route learned from a peer/provider — should it be advertised to another peer or provider? | No | Export rule: learned from a customer → tell everyone; learned from a peer/provider → tell only your customers. Only forward traffic that makes you money. |
| BGP always picks the path with the shortest AS-path. | False | Policy / LocalPref (business relationships) comes first, then AS-path length. Money beats short paths. |
| How does BGP prevent loops? | AS-path | path-vector: advertisements carry the full AS-path; if you see your own AS in it, discard. valley-free: uphill → ≤1 peer flat edge → downhill. |
| TCP · Congestion Control (midterm scope) |
| Do SYN and FIN each consume a sequence number? | 1 each | Don't forget when computing seq/ack: SYN takes 1 sequence number, FIN takes 1 too. ISN is random. |
| What does the ACK number mean? | Next expected byte | ack = last contiguously received byte + 1. Cumulative ACK: a missing middle segment freezes the ack → duplicate acks → 3 dups trigger fast retransmit. |
| UDP provides reliable, in-order delivery. | False | UDP is connectionless, unreliable, unordered; it only adds ports + a checksum. Want reliability? Build it in the application layer. |
| "Slow start" is slow, linear growth. | False | The name lies: slow start is exponential growth (doubles every RTT). Linear is congestion avoidance (AIMD, +1 per RTT). |
| Are timeout and 3-dup-ACK handled the same way? | No | Timeout: ssthresh=cwnd/2, cwnd=1, back to slow start. 3 dup ACKs: ssthresh=cwnd/2, cwnd=cwnd/2, stay in CA. |
| What is the actual send window? | min(cwnd,rwnd) | Take the min of congestion window cwnd (protects the network) and receive window rwnd (protects the receiver). AIMD converges to fairness, but flows with smaller RTT grab more. |
| π DNS |
| DNS query order: root → TLD → authoritative. | True | Hierarchical delegation: root knows the TLD servers (.com etc.); TLD knows each domain's authoritative server; authoritative gives the final answer. |
| In a recursive query, the root server queries the TLD server on the resolver's behalf. | False | root/TLD typically only do iterative service: they return a referral ("go ask that one"). The one doing recursion is the local resolver (it walks the whole chain for the client). |
| Resolver-cached records can be used forever. | False | Every record carries a TTL; once expired it must be re-queried. Short TTL → fast updates but more queries; long TTL → less traffic but changes propagate slowly. |
| A CNAME record maps a domain name to an IP address. | False | CNAME = alias → another domain name. Mapping to an IP is A (IPv4) / AAAA (IPv6). NS points to name servers, MX to mail servers. |
| What are glue records for? | Break circular deps | If example.com's NS is ns.example.com, resolving the NS requires resolving its IP first → infinite loop. The parent zone (TLD) attaches that NS's A record (glue) to break the cycle. |
| π HTTP · CDN |
| HTTP GET and POST have the same semantics. | False | GET fetches a resource (idempotent, cacheable); POST submits data (not idempotent). Also HEAD (headers only), PUT, DELETE. |
| What do status codes 301 and 404 mean? | Redirect / not found | 2xx success (200 OK), 3xx redirect (301 moved permanently, 304 Not Modified), 4xx client error (404), 5xx server error (500). |
| Benefit of persistent connections? | Save handshakes | Reuse one TCP connection for multiple requests, skipping per-request handshake + slow start. Pipelining saves more: fire multiple requests without waiting for replies (but suffers head-of-line blocking). |
| Which header implements conditional GET? | If-Modified-Since | Client sends If-Modified-Since / If-None-Match(ETag); if unchanged, server replies 304 Not Modified (no body), saving bandwidth. Cache freshness is governed by Cache-Control: max-age / Expires. |
| HTTP itself is stateful and can remember users. | False | HTTP is stateless. State comes from cookies: server sends Set-Cookie, and the client automatically attaches it to every later request. |
| How does a CDN steer users to the nearest edge server? | DNS redirection | The CDN controls the domain's authoritative DNS and returns the IP of a nearby edge server based on the user's (resolver's) location/load. Edges cache content: hit → serve directly, miss → fetch from origin. Benefits: low latency, less backbone bandwidth, absorbs hot spots. |
| π Ethernet · Switching · STP |
| MAC addresses are hierarchical (aggregatable) like IP addresses. | False | MAC is a 48-bit flat address (burned into the NIC, globally unique), not aggregatable; IP is hierarchical, assigned by topology. Hence L2 uses learning tables, L3 uses prefixes. |
| How does a switch learn the "MAC → port" mapping? | Source addresses | Learning: on receiving a frame, record (source MAC → ingress port). Look up the destination MAC: hit → forward out one port; miss/broadcast → flood (all ports except ingress). Entries time out. |
| What happens to broadcast frames when an L2 network has a loop? | Loop forever | Ethernet frames have no TTL → broadcast storm, learning-table thrashing. That's why STP prunes the physical loop into a logical tree. |
| Who does STP elect as root? What about non-tree ports? | Lowest ID | root = the bridge with the lowest ID; each switch picks its best path by (distance to root, neighbor ID…); non-tree ports are blocked (no data forwarding, but they still listen to BPDUs). Link failure triggers automatic recomputation. |
| π ARP · DHCP · NAT · TLS |
| ARP resolves what to what? | IP→MAC | Within a subnet: broadcast "who has IP x.x.x.x?" → target host replies with its MAC by unicast. Result goes into the ARP cache (with a timeout). Leaving the subnet, you ARP for the gateway's (default gateway) MAC. |
| Order of the four DHCP steps (DORA)? | D-O-R-A | Discover (client broadcasts to find servers) → Offer (server offers an IP) → Request (client broadcasts its choice) → Ack (confirmation + lease). Also delivered: subnet mask, gateway, DNS server. Lease must be renewed on expiry. |
| What's the key of the NAT translation table? | 5-tuple/port | Outbound: rewrite (private IP:port) → (public IP:new port) and record the mapping; inbound replies are reverse-looked-up and rewritten back. Many hosts share one public IP, distinguished by port. Side effect: outsiders can't initiate connections in (needs port mapping/hole punching); breaks E2E. |
| What is a certificate for in TLS? | Prove identity | A certificate = a "domain ↔ public key" binding signed by a CA's private key. The client verifies the signature with its built-in CA public key → trusts the server's public key → prevents man-in-the-middle. Trust chain: root CA → intermediate CA → site certificate. |
| After the TLS handshake, all data is encrypted with the public key. | False | Asymmetric (public-key) crypto is used only for the handshake/key exchange (e.g. Diffie-Hellman; verify the cert, negotiate a symmetric session key); data afterwards uses symmetric encryption (much faster). TLS provides: confidentiality + integrity + server authentication. |
| π Datacenters |
| What does east-west traffic mean in a datacenter? | Server-to-server | east-west = server↔server inside the DC (the majority); north-south = DC ↔ external users. Heavy internal traffic → needs big bisection bandwidth. |
| Why use Clos / fat-tree instead of one big switch? | Small parts, big net | Build a large-scale, multipath, horizontally scalable topology from many cheap small-port switches; one giant switch is expensive and a single point of failure. |
| What does full bisection bandwidth imply? | Non-blocking | Cut the network in half: cross-cut bandwidth ≥ half the hosts at full rate → any host pairing can communicate at full speed simultaneously. Oversubscription = downlink capacity : uplink capacity (e.g. 4:1 means uplink is only 1/4). |
| What does ECMP split traffic on? | Flow hash | Equal-Cost Multi-Path: hash the 5-tuple to pick one equal-cost path → one flow stays on one path (in-order), different flows spread out. Downside: elephant flows can collide (uneven hashing). |
| π SDN · Host Networking |
| The core idea of SDN? | Split control/data | Separate the control plane (route computation, logically centralized in a controller) from the data plane (forwarding, kept in switches). The controller has a global view and pushes rules to switches; traditional networks run distributed protocols on every box. |
| What do SDN switch forwarding rules look like? | match-action | match (on header fields, wildcards allowed) + action (forward/drop/rewrite headers/send to controller) + priority. Table misses can be punted to the controller. Flexible, but the controller is a single point / bottleneck (needs redundancy). |
| Why is kernel bypass (e.g. DPDK) fast? | Skips the kernel | The application polls the NIC directly to send/receive, skipping the kernel stack, syscalls, interrupts, and copies. Cost: burns CPU on polling, gives up general kernel features. RDMA goes further: the NIC reads/writes remote memory directly, no CPU involved. |
| Common NIC offloads? | Checksum/segm. | checksum offload, TSO/GSO (NIC splits large segments), LRO/GRO (receive coalescing), RSS (multi-queue hashing across cores). Moves per-packet work from CPU to NIC. |
| π Multicast · Collectives |
| Why is multicast better than repeated unicast? | Once per link | Forward along a distribution tree: each packet crosses each link once, duplicated at branch points → saves bandwidth. Group members use IGMP to tell the local router they join/leave a group. |
| What does RPF (Reverse Path Forwarding) check? | Arrival port | Only accept multicast packets that arrive on the port of the shortest path toward the source; drop everything else → prevents loops, prunes redundant flooding. |
| Difference between scatter and broadcast? | Chunks vs full copy | broadcast: root sends the same data to everyone; scatter: root splits the data, one chunk each; gather: collect chunks back; all-gather: everyone ends up with all chunks; reduce: aggregate (e.g. sum) to the root; all-reduce = reduce + broadcast (everyone gets the aggregated result). |
| Per-node communication volume of ring all-reduce? | 2(N−1)/N·D | Data D split into N chunks; reduce-scatter phase (N−1) steps + all-gather phase (N−1) steps, D/N per step → total 2(N−1)D/N ≈ 2D, essentially independent of N (bandwidth-optimal); the cost is 2(N−1) steps of latency. |
| π Wireless · Cellular |
| Higher SNR allows a higher transmission rate. | True | Higher signal-to-noise ratio → denser modulation usable → higher bit rate (Shannon). More distance/interference → SNR drops → rate automatically steps down. Wireless also suffers attenuation, multipath, obstruction — far higher error rates than wired. |
| What is the hidden terminal problem? | Can't hear each other | A and C both hear B but can't hear each other → transmitting to B simultaneously collides at B; carrier sense fails. Exposed terminal is the reverse: you hear someone else transmitting and hold back, though there'd be no collision (overly conservative). |
| Why does wireless use CSMA/CA instead of CSMA/CD? | Can't detect collisions | Radios are half-duplex and can't hear collisions while transmitting (their own signal swamps reception) → can't do CD (detection), only CA (avoidance): listen first, random backoff, and success only when the receiver returns a link-layer ACK. Optional RTS/CTS reserves the channel to mitigate hidden terminals. |
| How does a WiFi client join an AP? | Scan + associate | The AP periodically broadcasts beacons (SSID); the client scans → authenticates → association (binds to one AP). All traffic then relays through the AP. |
| Does the connection drop during a cellular handoff? | No | When a mobile device crosses cell towers, the network coordinates the handoff; the core network updates the path and the connection persists at the IP layer. Cellular architecture: device ↔ base station (RAN) ↔ core network ↔ Internet; spectrum is licensed (WiFi uses unlicensed bands). |