Networking
Question One: Can you explain the OSI model and its seven layers?**
**Answer:**
“The OSI model is a seven-layer conceptual framework used to understand how network communication works. Starting from Layer seven, the Application Layer provides network services to applications, such as HTTP, FTP, SMTP, and DNS. The Presentation Layer handles data representation, encoding, compression, and encryption concepts. The Session Layer manages sessions between applications. The Transport Layer provides end-to-end communication using protocols such as TCP and UDP. The Network Layer handles logical addressing and routing using IP. The Data Link Layer handles local network communication using frames and MAC addresses. Finally, the Physical Layer transmits raw bits over the physical medium. In security, the OSI model helps us understand where a network or application issue is occurring.”
— -
**Question Two: What is the difference between the OSI model and the TCP/IP model?**
**Answer:**
“The OSI model has seven layers, while the commonly used four-layer TCP/IP model has Application, Transport, Internet, and Network Access layers. The OSI model is mainly a conceptual and educational framework, while TCP/IP represents the protocol architecture used by the Internet. The OSI model is still useful because it provides a standardized way to understand networking, troubleshoot problems, and identify which layer a particular protocol or issue belongs to. In real-world networking, the TCP/IP protocol suite is what we primarily use.”
— -
**Question Three: What is TCP? Explain the three-way handshake and why TCP is reliable.**
**Answer:**
“TCP stands for Transmission Control Protocol. It is a connection-oriented transport-layer protocol that provides reliable and ordered delivery of data. Before transferring application data, TCP establishes a connection using a three-way handshake. First, the client sends a SYN segment with an initial sequence number. Second, the server responds with a SYN-ACK, acknowledging the client’s sequence number and providing its own sequence number. Third, the client sends an ACK to acknowledge the server’s sequence number. After this, the connection is established. TCP provides reliability through sequence numbers, acknowledgements, retransmissions, checksums, and flow control.”
— -
**Question Four: What is UDP, how is it different from TCP, and why would an application choose UDP?**
**Answer:**
“UDP stands for User Datagram Protocol. It is a connectionless transport-layer protocol with low overhead. Unlike TCP, UDP does not establish a connection before sending data and does not guarantee delivery, ordering, or retransmission. Applications may choose UDP when low latency and speed of delivery are more important than guaranteed delivery. Common examples include DNS, DHCP, TFTP, streaming, real-time voice and video, and online gaming. UDP is not inherently faster, but it avoids many of the mechanisms that add overhead to TCP.”
— -
**Question Five: What is an IP address? Explain public, private, static, and dynamic IP addresses.**
**Answer:**
“An IP address is a logical address assigned to a network interface that allows devices to communicate across networks. A private IP address is used inside private networks and is not directly routable over the public Internet. A public IP address is globally routable and can be used for Internet communication. NAT is commonly used to allow private hosts to communicate with the Internet through a public IP. A static IP is configured to remain consistent, while a dynamic IP is typically assigned automatically by DHCP for a lease period and may change.”
— -
**Question Six: What is subnetting, and what does `/24` mean?**
**Answer:**
“Subnetting is the process of dividing a larger IP network into smaller logical networks. In CIDR notation, `/24` means that twenty-four bits are used for the network portion of an IPv4 address, leaving eight bits for the host portion. Therefore, a `/24` network has two hundred and fifty-six total addresses. In a traditional IPv4 subnet, one address is used as the network address and one as the broadcast address, leaving two hundred and fifty-four usable host addresses.”
— -
**Question Seven: What is the difference between an IP address and a MAC address?**
**Answer:**
“An IP address is a logical address used for communication and routing between networks, while a MAC address is a Data Link Layer address used for local network delivery. A switch primarily uses MAC addresses to forward Ethernet frames within a local network. Routers use destination IP addresses to make forwarding decisions between networks. When communicating with a remote host, the local Ethernet frame is generally addressed to the MAC address of the next hop, usually the default gateway, while the IP packet contains the remote destination IP.”
— -
Get Keshri nandan’s stories in your inbox
Join Medium for free to get updates from this writer.
**Question Eight: What is ARP and how does it work?**
**Answer:**
“ARP stands for Address Resolution Protocol. It is used on an IPv4 local network to resolve an IP address to a MAC address. If a host wants to communicate with another host on the same network and does not know its MAC address, it sends an ARP Request as a broadcast asking who has the target IP address. The device that owns that IP responds with an ARP Reply containing its MAC address. The sender can then store the mapping in its ARP cache and use that MAC address for local Ethernet communication. If the destination is on a remote network, the host resolves the MAC address of the default gateway instead.”
— -
**Question Nine: What is DNS and what happens when you type a domain name into a browser?**
**Answer:**
“DNS stands for Domain Name System. It translates domain names into resource records such as IPv4 addresses and IPv6 addresses. When I enter a domain name in a browser, the system first checks available caches. If the required record is not cached, a DNS resolver obtains the appropriate record from the DNS hierarchy. The resolver returns the IP address to the client. The client then determines the route to the destination and prepares to communicate with the server. For a typical HTTPS connection, this is followed by TCP, TLS, and then HTTP communication.”
— -
**Question Ten: What is NAT? Explain SNAT and DNAT.**
**Answer:**
“NAT stands for Network Address Translation. It modifies IP addressing information as traffic passes through a network device. SNAT, or Source NAT, changes the source address of a packet, commonly when an internal host accesses the Internet. For example, a private host such as `192.168.1.10` may have its source address translated to a public address such as `203.0.113.50`. DNAT, or Destination NAT, changes the destination address. For example, traffic sent to a public address can be translated to an internal web server. When port translation is also performed, this is commonly called PAT or NAT overload.”
— -
**Question Eleven: What is the difference between HTTP and HTTPS? What role does TLS play?**
**Answer:**
“HTTP is an application-layer protocol used for communication between clients and web servers. HTTPS is HTTP protected by TLS. TLS provides confidentiality, integrity, and server authentication. During a TLS handshake, the client and server negotiate cryptographic parameters, authenticate the server using its certificate, and establish shared session keys. The HTTP data is then protected using those keys. HTTPS therefore protects data while it is travelling across the network, but it does not automatically protect the web application from vulnerabilities such as SQL injection, XSS, or broken access control.”
— -
**Question Twelve: What is a port, and why are ports important in VAPT?**
**Answer:**
“A port is a logical endpoint used by transport-layer protocols such as TCP and UDP. An IP address identifies the network destination, while the port identifies a particular service endpoint on that host. For example, TCP port four hundred forty-three is conventionally associated with HTTPS. During VAPT or network reconnaissance, we scan ports to determine which services are reachable and then perform service identification and security testing. An open port does not automatically mean a vulnerability exists, but it tells us that a service is exposed and may require further assessment.”
— -
**Question Thirteen: What is a firewall? Explain stateful and stateless firewalls.**
**Answer:**
“A firewall is a security control that monitors and filters network traffic according to configured security rules. The rules can consider factors such as source IP, destination IP, protocol, port, and connection state. A stateless firewall evaluates each packet independently based on its configured rules. A stateful firewall maintains information about active connections and can determine whether a packet belongs to an established or related connection. Stateful firewalls can therefore make filtering decisions based on the context of the connection.”
— -
**Question Fourteen: What is the difference between a hub, switch, and router?**
**Answer:**
“A traditional hub operates at Layer one and simply repeats incoming signals to its other ports without understanding MAC addresses. A switch primarily operates at Layer two and learns MAC addresses associated with switch ports, allowing it to forward Ethernet frames toward the appropriate port. A router primarily operates at Layer three and uses destination IP addresses and routing tables to forward packets between different networks. In simple terms, a switch connects devices within a local network, while a router connects different networks.”
— -
**Question Fifteen: What happens when you type `https://example.com` into a browser?**
**Answer:**
“When I enter `https://example.com`, the browser first needs to resolve the domain name to an IP address using DNS, unless the required information is already cached. Once the IP address is known, the host determines whether the destination is local or remote and selects the appropriate route. If the destination is remote, the host generally uses ARP to resolve the MAC address of the next hop, such as the default gateway. The client then establishes a TCP connection using the three-way handshake. Because this is HTTPS, a TLS handshake follows, where the server is authenticated and cryptographic session keys are established. After TLS is established, the browser sends the HTTP request through the protected connection. The server processes the request and sends an HTTP response back through the same secured connection.”
