Networking Interview Questions & Answers

DNS translates domain names into IP addresses, and since the misspelled domain isn't registered, there's no matching DNS record, so the browser can't find any server to connect to at all. It isn't a firewall or server error, because the request never even reaches a real server.

How fast HSRP notices the active router has actually failed is entirely driven by its hello and hold timers, the standby router is just watching for those regular hellos to stop. Shortening those timers means the standby detects a failure and takes over faster, directly cutting down the connectivity gap users experience.

Classic 802.1D can take up to about 50 seconds to fully settle down after the network topology changes, and during that window, brief loops or storms can occur. Rapid Spanning Tree (802.1w) redesigned how ports transition between states so that same convergence happens in just a few seconds instead, directly closing that risky window.

Ping only needs one single reply, from the final destination, to succeed. Traceroute needs a reply from EVERY router along the way to build its full picture, and if any of those routers are configured to ignore or rate-limit that specific kind of reply, traceroute shows gaps or timeouts even though the destination itself is perfectly reachable.

SNI lets the client announce which hostname it's trying to reach as part of the TLS handshake itself, before the server has to pick and send a certificate, which is exactly what allows one IP and port to correctly serve multiple certificates for multiple domains. Without SNI support (or an old client that never sends it), the server has to guess and falls back to a single default certificate, causing a mismatch for anyone requesting the other domain. Assigning a separate IP per domain is the older workaround from before SNI existed, and a wildcard certificate only helps if both domains happen to share the same base domain.

Since dig confirms DNS resolution is identical and correct from both locations, the problem lives beyond name resolution, and a connection that just hangs with no response, rather than an explicit rejection, is a classic symptom of a firewall or IP allowlist silently dropping the traffic rather than rejecting it outright. A hostname typo would have shown up as a DNS resolution failure in dig, which it did not.

A reverse proxy sits in front of one or more backend servers and accepts requests on their behalf, so clients only ever see the proxy's address, never the real servers. This is why load balancers, CDNs, and API gateways are usually built as reverse proxies. A forward proxy does the opposite: it sits in front of clients and hides THEIR identity from the servers they reach, which is the setup used for corporate outbound web filtering.

PAT doesn't just track by the shared public IP, it tracks by the COMBINATION of IP and port. So even though both internal hosts are sharing one public address, the router assigns each of their sessions a different translated port number, and that port is what lets return traffic get routed back to the correct internal host.

STUN lets each client discover its own public IP and port as seen from outside its NAT, which both sides can then exchange, often via a signaling server, to attempt hole punching, where both send packets simultaneously so each NAT sees outbound traffic and permits the matching return path. When NAT behavior is too restrictive for hole punching to work, such as symmetric NAT, the connection falls back to relaying all traffic through a TURN server instead. MASQUERADE is just the mechanism a NAT itself uses to rewrite outbound source addresses, it doesn't help two separate NATs punch through to each other.

An accidental physical loop lets a broadcast circle endlessly between two paths, multiplying itself into a storm that can bring a whole segment down. Spanning Tree Protocol exists specifically to detect that kind of redundant path and deliberately block one of the looping ports before it ever becomes a problem.