Network Fundamentals

You are not expected to be a network architect. You are expected to know which layer something breaks at, because that tells you where to start looking.

The two models you must know

Docusaurus aside, you need both OSI and TCP/IP. Interviewers ask for either.

#	OSI	TCP/IP	Devices	Protocols at this layer
7	Application	Application	—	HTTP, HTTPS, DNS, SMTP, SSH, RDP
6	Presentation	Application	—	TLS/SSL, ASCII, encoding
5	Session	Application	—	NetBIOS, RPC, SQL
4	Transport	Transport	Load balancer	TCP, UDP
3	Network	Internet	Router, L3 switch	IP, ICMP, ARP*, routing protocols
2	Data Link	Network Access	Switch, AP, bridge	Ethernet, 802.1Q VLAN, STP
1	Physical	Network Access	Hub, cable, NIC	Cabling, signals

*ARP is sometimes taught at layer 2 — it is the classic interview ambiguity. Say it bridges L2/L3.

◆How to use this at work

When a user says "no internet", you walk down the stack. Cables and link lights (L1), switch port and VLAN (L2), IP/gateway/route (L3), port and service (L4/L7). Most support interviews are really asking whether you can do that walk in the right order.

Hub vs switch vs router — the classic question

Device	Layer	Behaviour
Hub	1	Repeats bits to every port. One collision domain. Never use one.
Switch	2	Learns MAC addresses, forwards by MAC table. One collision domain per port, one broadcast domain.
Router	3	Routes between different networks using IP. Each interface is a separate broadcast domain.
Layer 3 switch	2–3	Routes at wire speed using a routing table.

★The 30-second answer

"A hub repeats everything to every port — one collision domain. A switch learns MAC addresses so each port is its own collision domain, but everything still shares one broadcast domain. A router moves traffic between different networks by IP address, and each of its interfaces is a separate broadcast domain."

What happens when you type a URL

This question appears in almost every interview. The answer, in order:

1. Browser cache — is the IP already known?
2. /etc/hosts or the Windows hosts file — is it mapped locally?
3. DNS query — the OS asks its configured resolver for an A record.
4. Resolver — if it has no cached answer, it recurses: root → TLD → authoritative.
5. ARP — the host finds the MAC address of its default gateway.
6. TCP handshake — SYN, SYN-ACK, ACK to port 443.
7. TLS handshake — certificate exchange and key agreement.
8. HTTP request — GET /path.
9. Response — HTML/CSS/JS flows back and the page renders.

⚠Where support work happens

Steps 2–5 are your daily bread. "Can't resolve DNS" and "can't reach the gateway" are the two most common faults a user reports, and they sit on completely different layers.

IP classes and private ranges

Range	Use
10.0.0.0/8	Private (Class A)
172.16.0.0/12	Private (Class B) — i.e. 172.16–172.31
192.168.0.0/16	Private (Class C)
127.0.0.0/8	Loopback
169.254.0.0/16	APIPA — means DHCP failed
224.0.0.0/4	Multicast

✖169.254.x.x is a diagnosis, not an address

When a Windows machine self-assigns 169.254.x.x, the DHCP request failed. That points at the DHCP server, the scope being exhausted, the VLAN being wrong, or the switch port not passing traffic — not at the PC itself.

ICMP and its tools

Tool	Layer	Tests
ping	3	Reachability + round-trip time
tracert / traceroute	3	Path and where it stops responding
arp -a	2/3	IP → MAC mappings
nslookup	7	DNS resolution

ℹWhy a ping can succeed and the service still fail

ICMP proves the host is reachable. It proves nothing about whether port 443 is open, whether TLS is valid, or whether the application is healthy. This distinction is the entire reason port testing is named in your JD.

ARP, DHCP and DNS — the three you will explain

• ARP maps an IP to a MAC address on the local segment. If ARP fails, traffic cannot leave the subnet even though pings "should" work.
• DHCP hands out address, mask, gateway, DNS and lease time automatically.
• DNS turns names into addresses so users never memorise them.

Next

IP Addressing & Subnetting — the most tested topic in the process.