Part 1: Fundamentals, IP & Transport

1. The OSI Model: The Universal Language

The OSI (Open Systems Interconnection) model is the conceptual framework for troubleshooting. If an interviewer asks how a network works, start here.

Layer	Name	Primary Function	Key Devices/Protocols
7	Application	Human-computer interaction.	HTTP, HTTPS, FTP, SMTP, DNS
6	Presentation	Formatting, encryption, compression.	SSL/TLS, JPEG, ASCII
5	Session	Dialogue control, start/end connections.	NetBIOS, RPC
4	Transport	End-to-end reliability, flow control.	TCP, UDP
3	Network	Logical addressing & routing.	Routers, IP, ICMP
2	Data Link	Physical addressing (MAC), framing.	Switches, MAC addresses, ARP
1	Physical	Raw bitstream transmission.	Cables, Hubs, Repeaters

Pro-Tip: If asked to troubleshoot, always work from Layer 1 upwards. Is it plugged in? (L1) Does the port light up? (L2) Can I ping the gateway? (L3).

---

2. TCP vs. UDP: Reliability vs. Speed

The most fundamental trade-off in networking.

• TCP (Transmission Control Protocol): Connection-oriented, guarantees delivery through acknowledgment, sequencing, and retransmission of lost packets.

• Analogy: Sending a registered letter that requires a signature.

• Use Cases: Web browsing, Email, File transfers.

• UDP (User Datagram Protocol): Connectionless, “best-effort” delivery. No error correction or sequencing. Extremely low latency.

• Analogy: Yelling across a room. You hope they hear you, but you don’t stop if they missed a word.

• Use Cases: Streaming, VoIP, Online Gaming, DNS.

---

3. The TCP Three-Way Handshake

An interviewer will ask this to see if you understand connection state management.

1. SYN: Client sends a request to synchronize with the server.
2. SYN-ACK: Server acknowledges the client’s request and sends its own synchronize request.
3. ACK: Client acknowledges the server’s request. Connection is established.

---

4. Addressing: MAC vs. IP

• MAC Address (Layer 2): Physical, 48-bit, “burned-in” address. It identifies the hardware NIC and remains constant regardless of which network the device joins.
• IP Address (Layer 3): Logical, 32-bit (IPv4) or 128-bit (IPv6) address. It identifies the device’s location on a specific network. It changes as the device moves between networks.

---

5. Essential Infrastructure Protocols

• DNS (Domain Name System): The “Phonebook of the Internet.” Translates domain names (e.g., google.com) into IP addresses.

• Flow: Local Cache $\rightarrow$ Recursive Resolver $\rightarrow$ Root Server $\rightarrow$ TLD Server (.com) $\rightarrow$ Authoritative Name Server.

• ARP (Address Resolution Protocol): The bridge between Layer 3 and Layer 2. It finds the MAC address associated with a known IP address on the local network segment.

• DHCP (Dynamic Host Configuration Protocol): Automates the assignment of IPs. Remember the DORA process: Discover (client), Offer (server), Request (client), Acknowledge (server).

---

6. Collision Domains vs. Broadcast Domains

• Collision Domain (L1/L2): A segment where data frames could collide. Hubs create a single collision domain; Switches eliminate collision domains by creating dedicated paths for each port.
• Broadcast Domain (L3): A segment where a broadcast packet (like an ARP request) is heard by all devices. Routers define the boundaries of broadcast domains; broadcasts do not pass through them.

---

Key Interview Scenario: “Ping Works, Website Doesn’t”

If you can ping an IP address but can’t open the site:

1. DNS Failure: The computer cannot translate the name to an IP.
2. Port Blocking: ICMP (Ping) is allowed, but the firewall is blocking Port 80/443.
3. App/Server Failure: The web server service on the target machine is down.

7. Classful Addressing & IP Classes

• IPv4 is 32-bit, written as four octets (e.g., 192.168.1.10).
• Classful addressing (the older scheme) split the address space by leading bits:

Class	Leading bits	Default mask	Hosts/network	Range
A	0	/8 (255.0.0.0)	~16M	1.0.0.0 – 126.x
B	10	/16 (255.255.0.0)	~65K	128.0.0.0 – 191.x
C	110	/24 (255.255.255.0)	254	192.0.0.0 – 223.x
D	1110	multicast	—	224.0.0.0 – 239.x
E	1111	reserved	—	240.0.0.0 +

• Special addresses: loopback 127.0.0.0/8 (usually 127.0.0.1 = the host itself); RFC 1918 private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (not routable on the public internet — used with NAT).

Subnetting Worked Example (the most-tested calculation)

Given: 192.168.1.0/24, need 4 subnets.

1. Borrow bits: 2^b ≥ 4 → b = 2 borrowed from the host portion.
2. New prefix: /24 + 2 = /26 → mask 255.255.255.192.
3. Block size: 256 − 192 = 64 addresses per subnet.
4. Enumerate: 192.168.1.0/26, .64/26, .128/26, .192/26.
5. Usable hosts each: 2^(32−26) − 2 = 2^6 − 2 = 62 (network + broadcast reserved).

Formula sheet: number of subnets = 2^borrowed; hosts per subnet = 2^(32−prefix) − 2. Always subtract 2 for network and broadcast addresses.

---

8. TCP Congestion Control

TCP doesn’t just ensure reliability — it also avoids overloading the network by adjusting its congestion window (cwnd).

• Slow Start: cwnd grows exponentially (doubles each RTT) — 1 → 2 → 4 → 8 → 16 — until it hits ssthresh.
• Congestion Avoidance (AIMD): above ssthresh, cwnd grows linearly (additive increase) — +1 per RTT — until loss.
• On loss (timeout or 3 duplicate ACKs): cwnd is cut — multiplicative decrease (halved on duplicate ACK, reset to 1 on timeout) and ssthresh is halved.

cwnd
  |      ____
  |    _/        <- AIMD (linear, +1/RTT)
  |  _/          <- slow start (exponential)
  |_/______
  0              -> time

• Flow control vs congestion control: flow control is receiver-driven (don’t overflow the receiver’s buffer — uses the window field); congestion control is network-driven (don’t overflow the network — uses cwnd).
• Sliding window: allows multiple in-flight packets (pipelining) — window size = min(receiver window, cwnd).

TCP States & TIME_WAIT

After the active closer sends FIN, it enters TIME_WAIT for 2×MSL (Max Segment Lifetime). Why 2MSL?

1. To ensure the final ACK isn’t lost (gives the peer time to retransmit FIN).
2. To let any stale segments from the old connection expire so they don’t corrupt a new connection reusing the same port pair.

• Full close sequence: FIN → ACK → FIN → ACK (each side closes independently). The side that closes first goes to TIME_WAIT; the receiving side goes to CLOSE_WAIT then LAST_ACK.