Network Layer & Routing

1. Which of the following is a key advantage of IPv6 over IPv4?

The big one is the 128-bit address space — a virtually infinite pool that removes the need for NAT.

Why it matters:

• IPv4 — 32-bit addresses (~4.3 billion). We ran out, which is why NAT exists to share one public IP among many devices.
• IPv6 — 128-bit addresses. Every device can have its own globally unique address, so NAT becomes unnecessary.

Bonus advantages:

• Built-in IPSec — security integrated by design.
• SLAAC — stateless address autoconfiguration; devices can assign their own addresses without a DHCP server.

2. What is the functional purpose of a Subnet Mask in network configuration?

A subnet mask splits an IP address into a Network ID and a Host ID.

IP:         192.168.10.45
Mask:       255.255.255.0
Network ID: 192.168.10.0   (host bits = 0)
Host ID:             .45

Why it matters:

• Routers use the Network ID to decide where to send traffic — same network = deliver locally, different network = route elsewhere.
• It defines how big a subnet is (how many hosts fit).

Example: with 255.255.255.0, the first 24 bits are the network and the last 8 bits identify the host — so up to 254 usable addresses in that subnet.

3. What is the primary purpose of an IP address in computer networking?

An IP address identifies and locates a device on a network so it can communicate.

Sender: "Send this to 192.168.1.50"
        ↓
Network routes it to the device with that IP

Two roles:

• Identification — uniquely names a device on the network.
• Locating — the address helps routers find where the device is and deliver data to it.

Like a mailing address: it both says who you are (your house) and where you are (so mail can be delivered). Every message carries the destination IP, and the network uses it to route correctly.

An IP address is logical — unlike the MAC address (physical, hardware), the IP can change and is managed by the network layer.

4. What is the operational purpose of a Brouter (Bridging Router)?

A brouter is a hybrid of a router and a bridge.

• For routable protocols (like IP), it acts as an intelligent Layer 3 router — making forwarding decisions by IP address.
• For non-routable protocols (like NetBIOS), it falls back to being a Layer 2 bridge — forwarding frames by MAC address.

IP traffic    →  routed by IP (Layer 3)
NetBIOS, etc. →  bridged by MAC (Layer 2)

It’s a practical device for networks that carry a mix of routable and legacy, non-routable traffic — you get routing where possible and bridging where necessary.

5. What is the correct structural sequence for the 4-step DHCP lease process?

The DHCP lease process is the DORA sequence:

1. Discover — client broadcasts "Is there a DHCP server?"
2. Offer    — server replies "You can use 192.168.1.50"
3. Request  — client says "Yes, I'd like that address"
4. Acknowledge — server confirms, lease begins

Client ──Discover──→ Server
Client ←──Offer──── Server
Client ──Request──→ Server
Client ←──Ack────── Server   (lease active)

DORA: Discover, Offer, Request, Acknowledge.

6. How does Multi-Protocol Label Switching (MPLS) accelerate data routing across a network backbone?

MPLS attaches a short fixed-length label to each packet and forwards on the label, instead of doing a full routing-table lookup on the destination IP at every hop.

Classic routing:  parse IP header → longest-prefix lookup in routing table → forward
MPLS:             read short label → look up label table → forward (much faster)

How it works:

1. At the network edge, a router assigns a label based on the destination (and QoS needs).
2. Every core router just swaps/reads the small label — no deep IP processing.
3. At the far edge, the label is popped and the packet exits normally.

MPLS sits between Layer 2 and Layer 3, which is why it’s called “multi-protocol” — it can carry IP, ATM, frame relay, and more, all under the same label scheme. Less per-packet work = faster, more predictable backbone throughput.

7. Which OSPF area type is highly restrictive, blocking both external internet routes and summary routes from other internal areas?

Totally Stubby Area.

OSPF areas, from least to most restrictive:

Area type	External routes	Inter-area summaries	Default route
Normal	✓	✓	optional
Stub	✗	✓	yes
Totally Stubby	✗	✗	yes
NSSA	limited (via ASBR)	✓	yes

A Totally Stubby Area blocks:

• All external routes (from other routing domains / the internet)
• All summary routes from other OSPF areas

It keeps only intra-area routes plus a single default route pointing out. Small, stub networks (a branch office) need no detail — everything unknown just goes to the default route. That shrinks the routing table dramatically and cuts OSPF link-state traffic.

8. What is the primary role of the Border Gateway Protocol (BGP) on the global internet?

BGP routes traffic between Autonomous Systems — the independent networks that make up the internet (ISPs, large enterprises, clouds).

    AS 100 (ISP A)          AS 200 (ISP B)          AS 300 (Cloud)
    ──────────────── BGP ──────────────── BGP ────────────────

Key points:

• An Autonomous System (AS) is a network under one administrative control, identified by an AS number.
• BGP is a path-vector protocol — it exchanges reachability + path attributes (AS path, next hop, local pref, communities).
• Path selection is driven by administrative policy, not raw speed. An operator can say “prefer this ISP’s link, never route through that one” — business rules over shortest path.

Without BGP, the separate ASes couldn’t coordinate; the internet is literally stitched together by BGP peers exchanging route advertisements.

9. What diagnostic capability does a Traceroute (or Tracert) utility provide that a standard Ping cannot?

Traceroute maps the exact hop-by-hop path of routers a packet takes; Ping only tells you whether the destination is reachable.

How it works: it sends probes with an incrementing TTL (Time-To-Live).

TTL=1 → first router replies "TTL exceeded" → hop 1's address
TTL=2 → second router replies               → hop 2's address
TTL=3 → third router replies                → hop 3's address
...until the destination answers

You ──[R1]──[R2]──[R3]── Web server
      1.1.1.1  2.2.2.2  3.3.3.3
      ← hop 1  ← hop 2  ← hop 3

Ping: “is it up?” Traceroute: “which path does it take, and where is the bottleneck?” Each TTL-expired reply names a router interface, so you see the full route and can pinpoint where latency spikes or traffic stops.

10. How does a Multi-Layer Switch (MLS) differ from a traditional standard Layer 2 Switch?

• Layer 2 switch — forwards frames within a segment using MAC addresses. It can’t route between subnets.
• Multi-Layer Switch (MLS) — does Layer 2 switching and has built-in hardware routing engines to forward packets between subnets using IP addresses.

Layer 2 switch:  [MAC forwarding only]         → one subnet
MLS:             [MAC forwarding] + [IP routing] → many subnets, fast

An MLS is essentially a switch + router in one box, with routing done in hardware (ASICs) so it’s much faster than a general-purpose router. Used heavily in data centers and campus networks where you need both functions at line rate.

11. How do the metric calculations of the Open Shortest Path First (OSPF) protocol differ from the Border Gateway Protocol (BGP)?

• OSPF (interior gateway protocol, runs inside one AS) computes a Cost = reference bandwidth / link bandwidth. Faster links → lower cost → preferred path. Pure technical optimization.
• BGP (exterior gateway protocol, runs between ASes) uses Path Vector attributes — AS-path length, next-hop, local preference, MED — and applies administrative policy rules.

OSPF:  cost 10 ──┐
cost 1 ──┐       │
         ├── shortest total cost wins
cost 5 ──┘       │
                 └── pure link speed math

BGP:  choose path by *policy* ("prefer ISP X"), AS-path length, etc.
      business rules override raw speed

OSPF picks the fastest path; BGP picks the path the policies say to use.

12. What characterizes a Private IP address space as defined by RFC 1918 rules?

Private IPs are reserved for internal local networks and cannot be routed on the public internet without NAT.

The RFC 1918 ranges:

10.0.0.0/8        → 10.0.0.0 – 10.255.255.255
172.16.0.0/12     → 172.16.0.0 – 172.31.255.255
192.168.0.0/16    → 192.168.0.0 – 192.168.255.255

Key facts:

• Internet routers drop these addresses — they only work inside a private network.
• Many devices inside a LAN can reuse the same private range (e.g., every home router hands out 192.168.x.x).
• To reach the internet, a device uses NAT at the edge — the router translates the private IP into its single public IP.

Private space solves IPv4 exhaustion by letting billions of devices share far fewer public addresses.

13. What is the purpose of a host Loopback Address, and what are its standard values in IPv4 and IPv6?

The loopback address lets a device send traffic to itself — useful for testing network software without any physical interface.

• IPv4: 127.0.0.1 (whole 127.0.0.0/8 range is reserved)
• IPv6: ::1

app → 127.0.0.1 → "network stack" → back to the same machine

Use cases:

• Testing a web server running locally (curl http://127.0.0.1).
• Verifying the TCP/IP stack works without cables.

Think of it as the network saying “talk to myself.” It never leaves the machine, so no NIC, router, or cable is involved.

14. Which structural field is found inside a standard IPv4 Packet Header?

Time to Live (TTL).

The IPv4 header contains fields like: version, IHL, ToS, total length, identification, flags, fragment offset, TTL, protocol, header checksum, source IP, destination IP.

The distractors are all TCP segment (Layer 4) fields:

• Sequence Number — TCP
• Window Size — TCP
• Urgent Pointer — TCP

TTL belongs to the Layer 3 IP header. It’s an 8-bit field counting down router hops (see next question).

15. What is the function of the 8-bit Time to Live (TTL) field in an IP header?

TTL limits a packet’s lifespan to prevent infinite routing loops.

Every router that forwards the packet decrements TTL by 1:

TTL=4:  Router 1 (→3)  Router 2 (→2)  Router 3 (→1)  Router 4 (→0)  DROP

• Normal path: plenty of TTL left, packet arrives fine.
• Routing loop: the packet bounces between routers forever — but each hop drops TTL by 1. When it hits 0, the router drops the packet and (optionally) sends an ICMP “TTL exceeded” back.

Without TTL, a single misconfigured route could loop packets indefinitely and saturate the network. It’s the network’s built-in self-destruct timer. (Traceroute even abuses it — see the CN Top-25 part 2 page.)

16. Which layer issue CANNOT be detected by a standard IP Header Checksum calculation?

The IP header checksum only validates the Layer 3 header fields — not the payload and not Layer 2.

It CAN detect:

• Corrupted source IP
• Altered TTL
• Bad protocol field

It CANNOT detect:

• Corruption in the payload data (that’s TCP/UDP’s checksum job)
• Layer 2 physical bit errors (the Ethernet Frame Check Sequence handles those)

Why the split? Each layer protects its own territory: IP protects the header so routers don’t misroute; TCP/UDP protect the data end-to-end; Ethernet protects the frame on the wire.

17. How does Anycast routing differ from Multicast routing?

• Multicast — one-to-many. One sender delivers to a group of subscribed hosts simultaneously, using special group addresses (224.0.0.0/4). Live video to many viewers is multicast.
• Anycast — one-to-closest. Multiple servers share the same IP address; routers deliver each packet to the single nearest/lowest-cost of those servers. DNS root servers and CDNs use anycast.

Multicast:  sender → [group of many receivers]
Anycast:    client → routers pick → nearest of several identical servers

Multicast fans data out to many; anycast just picks the best one out of a crowd of look-alikes.

18. What is classful addressing and what are the IP classes?

Classful addressing divides IPv4 into fixed-size classes by the first bits of the address. The default subnet masks are built in:

Class	First bits	First octet	Default mask	Use
A	0	0–127	/8 (255.0.0.0)	Huge networks (16M hosts)
B	10	128–191	/16 (255.255.0.0)	Medium networks (65K hosts)
C	110	192–223	/24 (255.255.255.0)	Small networks (254 hosts)
D	1110	224–239	—	Multicast
E	11110	240–255	—	Reserved (research)

Key details:

• Class A is 0.0.0.0–127.255.255.255; the loopback 127.0.0.1 lives in Class A.
• Class D is multicast (224.0.0.0/4); Class E is experimental — neither is for normal host addressing.
• In classful routing, the class determines the network/host split — there’s no subnetting concept, which is exactly why it was replaced by CIDR (classless, any prefix length, e.g. /20). CIDR is why you can now carve arbitrary-sized blocks instead of being stuck with whole A/B/C classes.

19. How do you subnet — a worked example?

Subnetting borrows host bits to create smaller networks. Worked example: you have 192.168.1.0/24 and need 4 subnets.

Step 1 — find how many bits to borrow. To get 4 subnets, borrow 2 host bits (2² = 4). New mask: /24 + 2 = /26 (255.255.255.192).

Step 2 — find the block size. Block size = 256 − subnet octet = 256 − 192 = 64 addresses per subnet.

Step 3 — enumerate the subnets (increment by the block):

192.168.1.0   → 192.168.1.63     (hosts .1–.62, broadcast .63)
192.168.1.64  → 192.168.1.127
192.168.1.128 → 192.168.1.191
192.168.1.192 → 192.168.1.255

Each subnet has 62 usable hosts (64 − 2 for network + broadcast).

The quick formulas: number of subnets = 2^(borrowed bits); usable hosts per subnet = 2^(host bits) − 2. Host bits = 32 − prefix length. For /26: 2^(32−26) − 2 = 64 − 2 = 62. Always subtract 2 — the network address (all host bits 0) and broadcast address (all host bits 1) are not assignable. This is the single most-tested calculation in placement networking.

20. What is the difference between Distance Vector and Link State routing?

The two families of dynamic routing algorithms:

• Distance Vector (DV) — each router tells its neighbors its entire routing table (destination, distance) periodically. Routers build their tables from their neighbors’ claims. Bellman-Ford is the algorithm. Simple, but slow to converge and suffers count-to-infinity — a dead link can bounce wrong hop counts back and forth before settling. Example: RIP (hops as metric, max 15).
• Link State (LS) — each router floods the network with info about its own directly-connected links (state + cost), so every router builds the same complete map of the topology. Each then runs Dijkstra’s algorithm locally to compute shortest paths. Converges fast, no count-to-infinity, scales better. Example: OSPF.

	Distance Vector	Link State
Knows	Neighbors’ tables	Full network map
Algorithm	Bellman-Ford	Dijkstra
Convergence	Slow	Fast
Failure problem	Count-to-infinity	None (re-floods)
Example	RIP	OSPF

Count-to-infinity is fixed with split horizon and poison reverse (never advertise a route back to the neighbor it came from). The interview takeaway: DV is “ask your neighbors, spread the rumor”; LS is “share the map, compute locally.”

21. What is NAT and what is ICMP?

NAT (Network Address Translation) maps private addresses to a public address so many devices can share one public IP. Types:

• Static NAT — one private IP ↔ one fixed public IP (1:1). For servers needing a stable public identity.
• Dynamic NAT — private IPs draw from a pool of public IPs (many:few).
• PAT (Port Address Translation / NAT overload) — many private IPs share one public IP, distinguished by different port numbers (e.g. 192.168.1.5:12345 and 192.168.1.6:12345 both map to 203.0.113.1 but on different ports). This is what home routers use.

Home LAN:  192.168.1.5 ─┐
           192.168.1.6 ─┼─→ PAT → 203.0.113.1:portX / :portY → Internet
           192.168.1.7 ─┘

NAT conserves IPv4 addresses and hides the internal network — which is why IPv6’s huge space makes it unnecessary.

ICMP (Internet Control Message Protocol) is the network layer’s diagnostic/reporting protocol. It doesn’t carry user data — it carries status: ping uses ICMP Echo Request/Reply to test reachability; routers send “TTL exceeded” and “destination unreachable” messages (what traceroute relies on). Error reporting, not payload delivery.