🌐 Computer Networks & OSI Model: The Intuitive Interview Guide

How to use this guide:
Think of this as your senior engineer mentor explaining networking over coffee. No academic fluff, no useless byte-counting. Just clear mental models, practical explanations, and ready-to-use interview answers.

📑 Table of Contents

1. The Big Picture: Why Layers Exist
2. The 7 OSI Layers (The Compact Breakdown)
3. The Three Essential Addresses: MAC vs IP vs Port
4. Encapsulation & Decapsulation: The Envelope Journey
5. Transport Layer Deep Dive: TCP vs UDP, Flow & Congestion Control
6. The Supporting Cast: DHCP, DNS, ARP, Default Gateway & NAT
7. Network Devices: Switch vs Router & L4 vs L7 Load Balancer
8. The Complete End-to-End Story: Visiting a Website
   • 8.1 Mock Interview Script & Candidate Critique (google.com Walkthrough)
9. Interview Revision Sheet
10. Things I Actually Need to Remember (5-Minute Quick Read)

1. The Big Picture: Why Layers Exist

What is it?

Layering is simply breaking down the massive problem of "send data across the globe" into separate, smaller jobs. Each layer only cares about its own task and talks only to the layers immediately above and below it.

Why do we need it?

Without layers, your web browser would need to know whether your computer is using Wi-Fi or an Ethernet cable, how radio waves are modulated, and how global internet routers forward packets. Layering creates modularity: you can upgrade Wi-Fi to 5G without changing a single line of code in Google Chrome or HTTP.

Conceptual (OSI) vs Practical (TCP/IP)

• OSI (7 Layers) is a teaching model. It was designed by a committee in 1984 to describe how networking could theoretically work.
• TCP/IP (4 Layers) is what the real Internet actually runs on.

💡 Interview Reality Check:
In the real world, Presentation (Layer 6) and Session (Layer 5) are almost never separate layers. They are simply code libraries or application features built right into your program or operating system (e.g., your browser handles TLS encryption and HTTP keep-alive directly).

2. The 7 OSI Layers (The Compact Breakdown)

Here is every layer from top to bottom, explained clearly and concisely:

Layer 7 — Application

• Job: Interacts directly with software applications and user commands.
• Think: "What message does the application want to send?"
• Examples: HTTP, HTTPS, DNS, SSH, SMTP (Email), WebSockets.
• Important concepts: APIs, Request/Response payloads, URLs, Status codes.
• Simple example: Your browser creates an HTTP request: GET /index.html.
• Interview answer: "The Application Layer provides network services directly to end-user software, allowing applications to compose and consume messages."

Layer 6 — Presentation

• Job: Translates, encrypts, and formats data so both ends understand it.
• Think: "How should this data be formatted and secured so the receiver can read it?"
• Examples: TLS/SSL encryption, JSON/XML formatting, Gzip compression.
• Important concepts: Plaintext vs Ciphertext, Data serialization, Compression.
• Simple example: Encrypting credit card info with TLS so nobody on the wire can read it.
• Interview answer: "The Presentation Layer handles data formatting, serialization, compression, and encryption/decryption between the network and the application."

Layer 5 — Session

• Job: Starts, manages, and terminates the conversation between two computers.
• Think: "Who talks when, and how do we resume if interrupted?"
• Examples: Sockets (sockfd), RPC sessions, HTTP persistent connections (Keep-Alive).
• Important concepts: Dialog control (full vs half duplex), session checkpoints, connection recovery.
• Simple example: Keeping your payment session open while you type an OTP so you don't start from scratch.
• Interview answer: "The Session Layer establishes, coordinates, and tears down persistent communication sessions and dialogs between endpoints."

Layer 4 — Transport

• Job: End-to-end, process-to-process delivery.
• Think: "Which exact program on this computer gets the data, and did all the pieces arrive safely?"
• Examples: TCP (reliable), UDP (fast, best-effort).
• Important concepts: Port numbers (:443, :80), Sequence numbers, Acknowledgments, Flow control.
• Simple example: TCP ensuring a 5 MB file download arrives complete with zero missing bytes.
• Interview answer: "The Transport Layer provides process-to-process delivery using port numbers, and optionally guarantees reliability, sequencing, and flow control via TCP."

Layer 3 — Network

• Job: Host-to-host delivery across different networks (routing).
• Think: "What is the best path to get this packet across the global Internet to the destination computer?"
• Examples: IPv4, IPv6, ICMP (ping), Routers.
• Important concepts: IP addresses, Subnets, Routing tables, TTL (Time-to-Live).
• Simple example: Moving a packet from your home laptop across 12 ISP routers to a server in another country.
• Interview answer: "The Network Layer handles logical addressing via IP addresses and determines the best path for packets across multiple networks using routing."

Layer 2 — Data Link

• Job: Hop-to-hop transfer between two directly connected devices on the same physical link.
• Think: "How do I move this data across this specific cable or Wi-Fi channel to the next immediate machine?"
• Examples: Ethernet, Wi-Fi (802.11), Switches, Network Interface Cards (NICs).
• Important concepts: MAC addresses, Ethernet Frames, ARP, CRC error detection.
• Simple example: Your laptop sending a frame directly to your home Wi-Fi router.
• Interview answer: "The Data Link Layer handles reliable hop-to-hop frame delivery between directly connected devices on the same local network using MAC addresses."

Layer 1 — Physical

• Job: Moving raw bits (0s and 1s) over physical hardware.
• Think: "How do I turn 1s and 0s into electricity, light, or radio waves?"
• Examples: Ethernet cables, Fiber-optic glass, Wi-Fi radio frequencies, Hubs.
• Important concepts: Voltage levels, Light pulses, Radio signals, Physical connectors (RJ-45).
• Simple example: Turning binary bits into electrical voltage pulses over a copper wire.
• Interview answer: "The Physical Layer transmits raw, unstructured bit streams over physical transmission media using electrical, optical, or radio signals."

3. The Three Essential Addresses: MAC vs IP vs Port

To deliver a letter, you need a Country/City, a Street Address, and a Person's Name. Networking uses the exact same concept:

The Apartment Analogy:

• IP Address (142.250.190.46): Tells the world: "Go to 100 Main Street, New York". It gets the letter to the right building anywhere on Earth.
• Port Number (:443): Tells the building: "Deliver to Apartment 443". It tells the computer whether this packet is for Chrome, Spotify, or Discord.
• MAC Address (AA:BB:CC:DD:EE:FF): Tells the delivery person: "Hand this directly to the person sitting at the door right now". It is used only on the local link between two adjacent devices.

🗣️ One-Line Interview Answer:
"IP gets data to the right computer, Port gets data to the right application process on that computer, and MAC moves data hop-by-hop between directly connected devices on a local wire."

4. Encapsulation & Decapsulation: The Envelope Journey

What is it?

• Encapsulation: As data moves down the layers (Sender), each layer adds its own header (like putting a letter inside an envelope).
• Decapsulation: As data moves up the layers (Receiver), each layer strips off its header, reads it, and hands the inside data to the layer above.

The PDU (Protocol Data Unit) Ladder

Memorize this sequence—it is asked in almost every networking interview:

$$\text{Data (L7-5)} \longrightarrow \text{Segment (L4)} \longrightarrow \text{Packet (L3)} \longrightarrow \text{Frame (L2)} \longrightarrow \text{Bits (L1)}$$

🗣️ One-Line Interview Answer:
"Encapsulation wraps application data with transport, network, and data link headers as it moves down the stack, while decapsulation strips those headers off as data moves up at the destination."

5. Transport Layer Deep Dive: TCP vs UDP, Flow & Congestion Control

5.1 TCP vs UDP

What are they?

Two protocols at Layer 4 that define the rules for transmitting data between applications.

Why do we need both?

Different applications have different priorities: some need 100% reliability (a missing dollar in a bank transfer is a disaster), while others need raw speed and low latency (in an online game or video call, a dropped audio frame from 2 seconds ago is useless).

🗣️ One-Line Interview Answer:
"TCP is a connection-oriented, reliable protocol that guarantees ordered delivery via handshakes and retransmissions, whereas UDP is connectionless, fast, and lightweight with no delivery guarantees."

5.2 The TCP 3-Way Handshake

Before TCP sends a single byte of real data, client and server must agree that both can send and hear each other:

1. SYN (Synchronize): Client asks to connect and shares its starting Sequence Number.
2. SYN-ACK: Server agrees, shares its own starting Sequence Number, and acknowledges the client's number (Ack = Client_Seq + 1).
3. ACK (Acknowledge): Client acknowledges the server's number (Ack = Server_Seq + 1). The connection is now open!

🗣️ One-Line Interview Answer:
"The TCP 3-way handshake establishes a reliable connection using SYN, SYN-ACK, and ACK packets so both sides synchronize sequence numbers and verify bidirectional communication."

5.3 Sequence Numbers & TCP Reassembly

What is it?

When you send a 10 MB image, TCP breaks it into small chunks (segments). Because the Internet routes packets independently, Chunk #3 might arrive before Chunk #1.

How does TCP fix this?

• Every byte sent is assigned an incrementing Sequence Number (Seq).
• The receiving operating system stores incoming segments in a TCP buffer.
• It sorts them by their Sequence Number before handing the reconstructed, clean data stream to the application.
• If a segment is missing, the receiver sends an ACK asking for that specific sequence number again, triggering a retransmission.

5.4 Flow Control: Protecting the Receiver (rwnd & Sliding Window)

The Problem: Fast Sender vs. Slow Receiver

Imagine a high-speed server pumping data at 1 Gbps to a low-resource mobile device that can only read data at 10 Mbps. Without flow control, the receiver's memory buffer will quickly overflow, forcing the OS to drop packets.

How It Works: The Sliding Window & rwnd

1. Receiver Buffer: The receiving OS allocates a memory buffer (e.g., 64 KB) for the socket.
2. The Formula: $$\text{rwnd} = \text{Total Buffer Size} - \text{Bytes currently unread by application}$$
3. Advertising rwnd: In every single ACK packet, the receiver includes its current rwnd in the TCP header's Window Size field.
4. Sender Limit: The sender is strictly restricted from having more than rwnd unacknowledged bytes in flight.

What if rwnd == 0? (Zero Window & Persist Timer)

• When the receiver buffer fills completely, it advertises rwnd = 0.
• The sender pauses transmission immediately.
• Deadlock Risk: If the receiver application consumes data and sends an ACK reopening the window (rwnd = 32 KB), but that ACK is lost, both sides would wait forever!
• Solution (Zero Window Probe): The sender starts a Persist Timer. When it expires, it transmits a 1-byte Window Probe packet. The receiver is forced to reply with an ACK advertising its current rwnd, keeping the connection moving.

5.5 Congestion Control: Protecting the Network (cwnd, Slow Start & AIMD)

The Problem: Many Senders Overwhelming Network Routers

Even if the receiver has infinite memory (rwnd = ∞), the intermediate routers and switches across the Internet have limited queue buffers. If thousands of machines transmit full-blast simultaneously, router buffers fill up and drop packets, causing global network congestion collapse.

How It Works: The Congestion Window (cwnd)

• The sender maintains its own dynamic variable called cwnd (Congestion Window).
• Routers don't need to report their capacity; the sender dynamically senses available bandwidth by monitoring ACKs and packet loss.

[!IMPORTANT] The Golden Equation of TCP Rate Limiting: $$\text{Effective Transmission Window} = \min(\text{rwnd}, \text{cwnd})$$

• rwnd = "How much can the receiver take?" (Flow Control)
• cwnd = "How much can the network take?" (Congestion Control)

The 4 Phases of Congestion Control (TCP Reno / AIMD):

1. Slow Start (Exponential Growth):
   • Starts with cwnd = 1 MSS (Maximum Segment Size, typically ~1460 bytes).
   • For every ACK received, cwnd doubles each Round Trip Time ($1 \to 2 \to 4 \to 8 \to 16 \text{ MSS}$).
   • Continues exponential growth until reaching a threshold: ssthresh (Slow Start Threshold).
2. Congestion Avoidance (Additive Increase / Linear Growth):
   • Once cwnd \ge ssthresh, exponential ramp-up is too dangerous.
   • Switches to linear probing: increases cwnd by $+1 \text{ MSS}$ per RTT.
3. Loss Detection & Multiplicative Decrease:
   • Mild Loss (3 Duplicate ACKs): Receiver missed 1 segment but received subsequent ones.
     • Action (Fast Retransmit & Fast Recovery): Retransmit missing segment immediately without waiting for timeout, set $\text{ssthresh} = \frac{\text{cwnd}}{2}$, set $\text{cwnd} = \text{ssthresh}$, and resume linear growth.
   • Severe Loss (RTO / Timeout): No ACKs return at all (network stall).
     • Action: Set $\text{ssthresh} = \frac{\text{cwnd}}{2}$, reset $\text{cwnd} = 1 \text{ MSS}$, and restart from Slow Start.

5.6 Flow Control vs. Congestion Control: Quick Comparison

🗣️ One-Line Interview Answer:
"Flow Control prevents a fast sender from overflowing a slow receiver's buffer using the advertised rwnd window, while Congestion Control prevents senders from overwhelming intermediate network routers using the sender's dynamically adjusted cwnd window via Slow Start and AIMD."

6. The Supporting Cast: DHCP, DNS, ARP, Default Gateway & NAT

When your laptop wants to talk to a server on the Internet, it relies on five critical helper concepts:

6.1 DHCP (Dynamic Host Configuration Protocol)

• What is it? A protocol that automatically gives your computer an IP address when it joins a network.
• Why do we need it? Without it, you would have to manually type an IP, Subnet Mask, and Gateway IP every time you connect to a new Wi-Fi network.
• Real-world analogy: The hotel receptionist giving you a room key card when you check in.
• Interview answer: "DHCP automatically assigns IP addresses, subnet masks, default gateways, and DNS server IPs to devices joining a local network."

6.2 DNS (Domain Name System)

• What is it? The phonebook of the Internet. It translates human names (google.com) into computer IP addresses (142.250.190.46).
• Why do we need it? Humans cannot remember hundreds of 32-bit or 128-bit numerical IP addresses.
• How it works: Your laptop asks its configured DNS resolver, which looks up the name through root, TLD, and authoritative name servers.
• Interview answer: "DNS is a distributed hierarchical lookup system that resolves human-readable domain names into machine-routable IP addresses."

6.3 Default Gateway

• What is it? The local router that connects your home or office network to the outside world.
• Why do we need it? Your computer only knows how to talk directly to devices on its own local Wi-Fi subnet. When you want to send a packet to an IP address outside your house, your computer says: "I don't know where that is, so I'll hand it to my Default Gateway (my router) to figure out."
• Interview answer: "A Default Gateway is the local router node that an endpoint forwards traffic to whenever the destination IP is outside the local subnet."

6.4 ARP (Address Resolution Protocol)

• What is it? Translates a known Layer 3 IP Address into a Layer 2 MAC Address on the same local network.
• Why do we need it? Your computer knows the Gateway's IP (192.168.1.1), but to send an Ethernet frame over Wi-Fi/cable, your network card must put the Gateway's physical MAC address in the frame header.
• How it works:
  1. Your laptop broadcasts an ARP Request: "Who has IP 192.168.1.1? Tell me your MAC!" (Sent to broadcast MAC FF:FF:FF:FF:FF:FF).
  2. The router responds with an ARP Reply: "I have 192.168.1.1, my MAC is BB:BB:BB:BB:BB:BB."
  3. Your laptop saves this in its ARP Cache so it doesn't have to ask again for the next few minutes.
• Interview answer: "ARP resolves a known IP address to a physical MAC address on a local network segment via broadcast requests and unicast replies."

6.5 NAT (Network Address Translation)

• What is it? A feature running on your home router that allows multiple home devices to share one single public IP address.
• Why do we need it? IPv4 has only ~4.3 billion addresses, which is not enough for every phone, laptop, smart TV, and toaster on Earth.
• How it works:
  • Your laptop has a private IP (192.168.1.50).
  • When you visit a website, your router swaps your private IP with its single public IP (203.0.113.5) and notes the port number in a NAT Table.
  • When the website replies to the public IP, the router checks its table and forwards the reply back to your laptop.
• Interview answer: "NAT maps private local IP addresses to a single public IP address (and vice versa) using port numbers, conserving global IPv4 address space."

7. Network Devices: Switch vs Router & L4 vs L7 Load Balancer

7.1 Switch vs Router

• Switch: Connects computers together inside the same room or office. It never inspects IP addresses; it just reads the destination MAC address and sends the frame to the correct port.
• Router: Connects different networks together (e.g., your home LAN to the global ISP network). It inspects destination IP addresses to decide which network to forward to next.

🗣️ One-Line Interview Answer:
"A switch forwards frames within a single local network using MAC addresses, while a router routes packets between different networks using IP addresses."

7.2 L4 vs L7 Load Balancers

When a website gets millions of visitors, multiple backend servers share the load. A Load Balancer sits in front to distribute traffic.

🗣️ One-Line Interview Answer:
"An L4 load balancer routes traffic based purely on IP and Port without inspecting application data, while an L7 load balancer decrypts HTTP to make intelligent routing decisions based on paths, headers, and cookies."

8. The Complete End-to-End Story: Visiting a Website

Let's put every single piece together into one unified story.

The Scenario:

You open your browser on your Laptop (192.168.1.50) and type https://example.com/pay.

Step 1: Getting an IP & Setup (DHCP)

(Happens once when you turn on Wi-Fi)
Your laptop boots up, talks to the home router via DHCP, and receives:

• Its own private IP: 192.168.1.50
• The Default Gateway IP: 192.168.1.1 (the router)
• The DNS Server IP: 8.8.8.8

Step 2: Finding the Server's IP (DNS)

1. Your browser doesn't know where example.com lives. It crafts a DNS Query asking: "What is the IP of example.com?"
2. This DNS query is sent via UDP on port 53.
3. The DNS resolver answers: 93.184.216.34. Now we have our destination IP!

Step 3: Establishing the Connection (TCP Handshake)

Your laptop must open a reliable channel to 93.184.216.34 on port 443 (HTTPS):

1. Laptop sends SYN.
2. Server replies with SYN-ACK.
3. Laptop replies with ACK. (If HTTPS, a TLS cryptographic handshake happens immediately after to establish encryption keys).

Step 4: Encapsulation (Down the Stack on Your Laptop)

Your browser is ready to send the HTTP request: POST /pay {"amount": 500}:

1. Application (L7): Creates the HTTP request text.
2. Presentation (L6): TLS encrypts it into ciphertext.
3. Transport (L4): Adds a TCP Header (Src Port: 54321, Dst Port: 443, Sequence numbers) $\rightarrow$ Segment.
4. Network (L3): Adds an IP Header (Src IP: 192.168.1.50, Dst IP: 93.184.216.34) $\rightarrow$ Packet.
5. Data Link (L2): Your laptop realizes 93.184.216.34 is outside the local network. It must send the packet to the Default Gateway (192.168.1.1).
   • Looks up the router's MAC via ARP $\rightarrow$ BB:BB:BB:BB:BB:BB.
   • Wraps the packet in an Ethernet Frame:
     • Src MAC: AA:AA:AA:AA:AA:AA (Laptop)
     • Dst MAC: BB:BB:BB:BB:BB:BB (Router)
     • Adds a CRC error check trailer.
6. Physical (L1): Network card transmits the frame as radio waves (Wi-Fi) to the home router.

Step 5: Hop-by-Hop Travel (The Big Golden Rule!)

[!IMPORTANT] The Most Important Rule in Networking:

• IP addresses NEVER change from start to finish (they represent the ultimate source and ultimate destination).
• MAC addresses CHANGE AT EVERY SINGLE HOP (they represent who holds the packet on the immediate physical wire).

1. At Your Home Router:
   • Receives frame, checks CRC (no corruption).
   • Strips the Layer 2 MAC header.
   • Reads Layer 3 IP header: "Destination is 93.184.216.34".
   • Decrements TTL by 1 (e.g., 64 -> 63).
   • Applies NAT (replaces private IP with its public ISP IP).
   • Looks up its routing table, finds the next hop (ISP router).
   • Creates a brand-new Layer 2 frame with Src MAC: Router, Dst MAC: ISP Router.
   • Sends it down the wire.
2. Across the Internet Routers:
   • This process repeats across 10–15 routers across the country. Each router strips the old MAC, decrements TTL, inspects the IP, looks up its routing table, puts on a new MAC, and forwards it.

Step 6: Decapsulation (Up the Stack on the Server)

The packet reaches the destination server's network card:

1. Physical (L1): Converts incoming electrical/optical signals into bits.
2. Data Link (L2): Checks destination MAC matches its own. Verifies CRC trailer (no errors). Strips Ethernet header.
3. Network (L3): Checks destination IP matches its own. Strips IP header.
4. Transport (L4): Reads destination port 443. Places data in the TCP buffer, sends an ACK packet back to your laptop, and reorders chunks if necessary.
5. Session/Presentation (L5/L6): Wakes up the web server process; TLS decrypts the ciphertext back into plaintext JSON.
6. Application (L7): The web application reads POST /pay {"amount": 500}, processes the payment, and returns an HTTP 200 OK response (which makes the exact same journey back!).

8.1 Mock Interview Script & Candidate Critique (google.com Walkthrough)

Here is a side-by-side critique of a candidate's spoken response versus the Senior Engineer / High-Scoring Answer, highlighting the exact traps interviewers listen for.

🔍 Candidate Draft vs. Interviewer Critique

🎙️ The 10/10 Verbatim Interview Script

If an interviewer asks: "Explain what happens across all 7 OSI layers when I enter www.google.com in Chrome:"

"Here is how the request travels down the 7 layers on my machine and back up at Google's server:

1. Application Layer (L7): Chrome takes the URL and first checks the DNS cache (or queries a DNS resolver via UDP:53) to resolve google.com to its destination IP (e.g., 142.250.190.46). It then crafts the HTTP GET request string (GET / HTTP/1.1).
2. Presentation Layer (L6): If using HTTPS, this layer handles data formatting, compression, and TLS/SSL encryption—turning the plaintext HTTP request into encrypted ciphertext.
3. Session Layer (L5): Establishes, manages, and terminates the logical session between my browser and Google (managing keep-alive sockets and dialog synchronization).
4. Transport Layer (L4): Manages end-to-end, process-to-process delivery. It uses TCP for reliability. First, a 3-way handshake (SYN, SYN-ACK, ACK) establishes the connection. It attaches Source Port (ephemeral, e.g. 54321) and Destination Port (443), breaks the data into chunks, assigns sequence numbers, and manages flow/congestion control, producing a Segment.
5. Network Layer (L3): Handles host-to-host routing across networks. It takes the segment and attaches an IP header with Source IP (192.168.1.50) and Destination IP (142.250.190.46), producing a Packet. It consults the routing table to identify that the packet must leave via the Default Gateway (router).
6. Data Link Layer (L2): Handles hop-to-hop frame transfer on the local link. It uses ARP (Address Resolution Protocol) to resolve the Default Gateway's IP into its hardware MAC address. It wraps the packet into an Ethernet Frame with Source MAC (my laptop) and Destination MAC (home router), plus a CRC trailer for error checking.
7. Physical Layer (L1): The Network Interface Card (NIC) converts the binary frame bits into physical radio waves (Wi-Fi) or electrical/optical signals transmitted across the physical medium.

Once it hits the router and traverses ISP hops, MAC addresses are swapped at every hop while IPs stay constant, until Google's server decapsulates the layers from L1 back up to L7 to process the request."

9. Interview Revision Sheet

Top 12 High-Yield Questions & Spoken Answers

Q1: "What is the difference between the OSI model and the TCP/IP model?"

• Spoken Answer: "The OSI model is a 7-layer theoretical reference framework, while the TCP/IP model is the 4-layer practical architecture that the Internet actually runs on. In TCP/IP, OSI's Application, Presentation, and Session layers are collapsed into a single Application layer, and Data Link and Physical are combined into the Network Access layer."
• Follow-up: "Why aren't Presentation and Session separate layers in real life?"
  • Answer: "Because their tasks—like encryption, data serialization, and session management—are easily handled directly inside application libraries or the OS socket API."

Q2: "What is the difference between TCP and UDP?"

• Spoken Answer: "TCP is connection-oriented, reliable, and guarantees ordered delivery using a 3-way handshake, sequence numbers, and retransmissions. UDP is connectionless and lightweight—it sends datagrams without verifying delivery or ordering, making it much faster for real-time applications like video streaming or gaming."
• Follow-up: "Does DNS use TCP or UDP?"
  • Answer: "DNS primarily uses UDP on port 53 for speed because queries are small and fit into a single packet. However, it falls back to TCP for large responses (over 512 bytes) or zone transfers."

Q3: "Explain the TCP 3-Way Handshake."

• Spoken Answer: "It's the process used to establish a reliable TCP connection: First, the client sends a SYN packet with its initial sequence number. Second, the server responds with a SYN-ACK acknowledging the client's number and sharing its own sequence number. Finally, the client sends an ACK packet. Both sides are now synchronized and ready to exchange data."

Q4: "Why do we need both IP addresses and MAC addresses?"

• Spoken Answer: "IP addresses are logical and hierarchical; they tell routers where a device is located globally so packets can be routed across different networks. MAC addresses are physical and flat; they identify a specific hardware interface locally so devices on the same physical wire or Wi-Fi channel can pass frames to each other."

Q5: "What happens to IP and MAC addresses as a packet crosses routers?"

• Spoken Answer: "The Source and Destination IP addresses stay the same end-to-end throughout the journey. However, the Source and Destination MAC addresses are stripped and rewritten at every single router hop to reflect the immediate sender and immediate receiver on that specific local link."

Q6: "What is ARP and how does it work?"

• Spoken Answer: "ARP stands for Address Resolution Protocol. It translates a known Layer 3 IP address into a Layer 2 MAC address on the local network. The sender broadcasts an ARP request asking 'Who has this IP?', and the device owning that IP replies with its MAC address, which the sender then caches."

Q7: "What is the role of the Default Gateway?"

• Spoken Answer: "A Default Gateway is the local router your device sends packets to whenever the destination IP address is outside the local network subnet. Your computer knows it cannot reach the destination directly, so it hands the packet to the gateway to route it forward."

Q8: "What is NAT and why do we use it?"

• Spoken Answer: "NAT stands for Network Address Translation. It maps multiple private IP addresses inside a local home or office network to a single public IP address using port numbers. It was created to slow down the exhaustion of IPv4 addresses."

Q9: "What is the difference between a Switch and a Router?"

• Spoken Answer: "A switch operates at Layer 2 and connects devices within the same local network using MAC addresses and a CAM table. A router operates at Layer 3 and connects different networks together, forwarding packets across the Internet using IP addresses and a routing table."

Q10: "What is the difference between an L4 and an L7 Load Balancer?"

• Spoken Answer: "An L4 load balancer operates at the Transport layer, forwarding packets based purely on IP and Port without inspecting or decrypting the content. An L7 load balancer operates at the Application layer, terminating TLS and reading HTTP headers, cookies, and URL paths to make intelligent routing decisions."

Q11: "What are the PDUs at each layer?"

• Spoken Answer: "Application layer is Data or Message, Transport layer is Segment for TCP or Datagram for UDP, Network layer is Packet, Data Link layer is Frame, and Physical layer is Bits."

Q12: "What is the purpose of TTL (Time-to-Live) in an IP packet?"

• Spoken Answer: "TTL is an 8-bit counter in the IP header that prevents packets from looping endlessly in the network if there is a routing misconfiguration. Every router that forwards the packet decrements the TTL by 1; if TTL reaches 0, the packet is dropped and an ICMP Time Exceeded message is sent back."

Common Traps & Confusions to Avoid

1. ❌ Mistake: Saying MAC addresses are used across the Internet.
   ✅ Correction: MAC addresses are completely local. Your MAC address never leaves your home router!
2. ❌ Mistake: Thinking HTTP/HTTPS establishes the connection.
   ✅ Correction: TCP establishes the connection (3-way handshake); HTTP is just the text/data sent over that connection.
3. ❌ Mistake: Confusing Port numbers with IP addresses.
   ✅ Correction: IP gets you to the computer; Port gets you to the specific application running inside that computer.
4. ❌ Mistake: Claiming routers read MAC addresses to route packets.
   ✅ Correction: Routers inspect the destination IP to make routing decisions, then generate a new MAC to send it to the next hop.

10. Things I Actually Need to Remember (5-Minute Quick Read)

If your interview is in 10 minutes, review this exact section:

1. The 7 Layers Mnemonic (Top $\rightarrow$ Bottom)

• All People Seem To Need Data Processing
• Application $\rightarrow$ Presentation $\rightarrow$ Session $\rightarrow$ Transport $\rightarrow$ Network $\rightarrow$ Data Link $\rightarrow$ Physical

2. The PDU Sequence

$$\text{Data} \longrightarrow \text{Segment (TCP)} \longrightarrow \text{Packet (IP)} \longrightarrow \text{Frame (MAC)} \longrightarrow \text{Bits (Wire)}$$

3. The 3 Addresses

• MAC (L2): Local hardware hop (changes every hop).
• IP (L3): Global host address (never changes end-to-end).
• Port (L4): Specific process / application (e.g., :443 = Web, :53 = DNS).

4. The 5 Core Helpers in One Sentence Each

• DHCP: Gives my laptop an IP and tells it who the router is.
• DNS: Turns website.com into an IP address.
• ARP: Finds the MAC address for a given IP on the local link.
• Default Gateway: The router you give packets to when the destination is outside your room.
• NAT: Lets all devices in your house share one public IP.

5. The Golden Packet Hop Rule

When crossing routers: IP addresses stay constant. MAC addresses change at every single hop.