Top 26 OSI Model Interview Questions & Answers (2026)

Last Updated: June 2026 | Level: Beginner to Advanced | Format: Q&A with Layer Diagrams, Protocol Tables, and Device Mapping

The OSI model is one of the most fundamental computer networks topics and appears in virtually every networking interview at both service companies and product companies. Candidates report that layer identification, protocol classification, and device mapping questions appear in written rounds at TCS NQT, Infosys InfyTQ, and Wipro NationalTalentHunt. Based on public preparation resources and candidate-reported accounts, questions about which protocols operate at which layer appear most frequently in placement written tests.

---

Table of Contents

1. OSI Model Overview (Q1-Q8)
2. Lower Layers (Q9-Q15)
3. Upper Layers (Q16-Q21)
4. Comparison and Design (Q22-Q26)

---

OSI Model Overview

Q1. What is the OSI model? Why was it created? Easy

The OSI (Open Systems Interconnection) model is a conceptual framework that standardizes how different network systems communicate with each other.

Created by: ISO (International Organization for Standardization) in 1984 (ISO 7498).

Why created:

• Different vendors' networking equipment and protocols were incompatible.
• OSI provided a common reference model that any vendor could follow.
• Enables interoperability: a network card from one vendor works with a router from another.
• Provides a common language for network engineers: "Is this a Layer 2 or Layer 3 problem?"

Reality: OSI itself is a reference model, not an implementation. The actual protocol suite used on the internet is TCP/IP. However, OSI terminology and layer concepts are universally used in networking education and troubleshooting.

---

Q2. What are the 7 layers of the OSI model? State the function and PDU of each. Easy

Mnemonic (top to bottom): Please Do Not Throw Sausage Pizza Away (P-D-N-T-S-P-A reading from bottom: Physical, Data Link, Network, Transport, Session, Presentation, Application).

Layer	Name	PDU (Data Unit)	Key Functions	Example Protocols
7	Application	Data	Interface for user applications	HTTP, FTP, SMTP, DNS, SSH
6	Presentation	Data	Encoding, encryption, compression	SSL/TLS, JPEG, MPEG, ASCII
5	Session	Data	Session management, synchronization	NetBIOS, RPC, PPTP
4	Transport	Segment	End-to-end delivery, port multiplexing	TCP, UDP, SCTP
3	Network	Packet	Logical addressing, routing	IP, ICMP, OSPF, BGP
2	Data Link	Frame	Physical addressing (MAC), error detection	Ethernet, Wi-Fi, PPP, ARP
1	Physical	Bits	Electrical/optical signal transmission	RJ45, Fiber optic, USB, Bluetooth

---

Q3. Explain data encapsulation and decapsulation. Easy

Encapsulation is the process of adding headers (and sometimes trailers) at each OSI layer as data moves down from Application to Physical.

Decapsulation is the reverse: removing headers as data moves up from Physical to Application at the receiver.

SENDING (encapsulation, top to bottom):

Application (Layer 7):
  Data: "GET /index.html HTTP/1.1"

Transport (Layer 4):
  [ TCP Header | Data ]  <- Segment
  (source port, dest port, seq#, ACK#)

Network (Layer 3):
  [ IP Header | TCP Header | Data ]  <- Packet
  (source IP, dest IP, TTL, protocol=6 for TCP)

Data Link (Layer 2):
  [ Ethernet Header | IP Header | TCP Header | Data | Ethernet Trailer ]  <- Frame
  (source MAC, dest MAC, CRC checksum)

Physical (Layer 1):
  [bits: 10110010...] <- actual electrical/optical signals

At the receiver (decapsulation, bottom to top):

• Physical: convert signals to bits.
• Data Link: check CRC, remove Ethernet header.
• Network: check IP, remove IP header.
• Transport: check TCP, reassemble segments if needed, remove TCP header.
• Application: hand original data to the application.

---

Q4. What is the role of each OSI layer in one sentence each? Easy

Layer	One-sentence role
7 Application	Provides network services directly to user applications (web browser, email client).
6 Presentation	Translates data formats, handles encryption/decryption and compression/decompression.
5 Session	Establishes, manages, and terminates communication sessions between applications.
4 Transport	Provides end-to-end data transfer with reliability (TCP) or speed (UDP) via port numbers.
3 Network	Routes packets from source to destination across multiple networks using IP addresses.
2 Data Link	Transfers frames between directly connected nodes using MAC addresses with error detection.
1 Physical	Transmits raw bits over the physical medium (cables, radio waves, fiber optic).

---

Q5. What are the network devices and which OSI layer does each operate at? Easy

Device	OSI Layer	Function
Hub	Layer 1 (Physical)	Repeats electrical signals to all ports; no intelligence
Repeater	Layer 1 (Physical)	Amplifies/regenerates signals to extend distance
Bridge	Layer 2 (Data Link)	Connects two LAN segments; filters by MAC address
Switch	Layer 2 (Data Link)	Connects multiple devices; forwards frames to correct port by MAC table
Router	Layer 3 (Network)	Routes packets between networks using IP addresses; connects LANs to WAN
Layer 3 Switch	Layer 3 (Network)	Switch with routing capability; used in large LANs
Firewall	Layer 3-7	Filters traffic based on rules (IP, port, protocol, application)
Load Balancer	Layer 4-7	Distributes traffic across servers (Layer 4: TCP/UDP; Layer 7: HTTP content-based)
Gateway	Layer 5-7	Protocol translation between different network types
NIC (Network Interface Card)	Layer 1-2	Hardware connecting host to network

---

Q6. Why is the layered model useful? What are the advantages? Easy

Advantages of the layered OSI model:

1. Modularity: Each layer can be developed, upgraded, and replaced independently. Switching from IPv4 to IPv6 (Layer 3 change) does not require changes at Layer 1 or Layer 7.

2. Interoperability: Different vendors implement different layers, and as long as each follows the standard interface between layers, equipment from any vendor interoperates.

3. Troubleshooting: A systematic framework for diagnosing network problems:

   • Can't ping? Layer 3 issue.
   • Ping works but no HTTP? Layer 7 issue.
   • No link light on switch? Layer 1 issue.

4. Standardization: Common reference language across the industry. Everyone knows what "Layer 2 protocol" means.

5. Encapsulation: Each layer adds its own header, independent of other layers. An HTTP server doesn't need to know about Ethernet frames.

---

Q7. What is the difference between Layer 2 and Layer 3 switching? Medium

Aspect	Layer 2 Switch	Layer 3 Switch
Operates at	Data Link (Layer 2)	Network (Layer 3)
Addressing used	MAC addresses	IP addresses
Forwarding decision	MAC address table	Routing table
Can route between VLANs	No (requires router)	Yes (inter-VLAN routing)
Protocols	Ethernet, 802.1Q	IP, static/dynamic routing (OSPF, RIP)
Use case	Within a VLAN or LAN segment	Between VLANs in a campus network
Speed	Faster (ASIC-based)	Slightly slower (routing overhead)
Example products	Cisco Catalyst 2960	Cisco Catalyst 3560

In data centers: Layer 3 switches handle inter-VLAN routing at wire speed. Routers handle internet-facing routing decisions (BGP, WAN).

---

Q8. What is the relationship between OSI and TCP/IP model? Easy

OSI Model (7 layers)          TCP/IP Model (4 layers)
+-------------------+          +-------------------+
| 7. Application    |          |                   |
| 6. Presentation   |   <-->   | Application       |
| 5. Session        |          |                   |
+-------------------+          +-------------------+
| 4. Transport      |   <-->   | Transport         |
+-------------------+          +-------------------+
| 3. Network        |   <-->   | Internet          |
+-------------------+          +-------------------+
| 2. Data Link      |   <-->   | Network Access    |
| 1. Physical       |          | (Link)            |
+-------------------+          +-------------------+

Mappings:

• OSI Application+Presentation+Session -> TCP/IP Application (HTTP, FTP, DNS, SMTP)
• OSI Transport -> TCP/IP Transport (TCP, UDP)
• OSI Network -> TCP/IP Internet (IP, ICMP)
• OSI Physical+Data Link -> TCP/IP Network Access (Ethernet, Wi-Fi)

Key difference in philosophy:

• OSI: Strict separation of concerns; Session and Presentation as distinct layers.
• TCP/IP: Pragmatic; only layers that are actually needed.

---

Lower Layers

Q9. What is the Physical layer (Layer 1)? What standards govern it? Easy

Physical layer transmits raw bits over a physical medium. It defines:

• Electrical signals: Voltage levels representing 0 and 1.
• Optical signals: Light pulses in fiber optic cables.
• Radio signals: Wi-Fi, Bluetooth, cellular.
• Physical connectors: RJ45 for Ethernet, LC connectors for fiber.
• Bit timing: How fast bits are sent (baud rate).

Standards:

Medium	Standard
Copper Ethernet	IEEE 802.3 (10BASE-T, 100BASE-TX, 1000BASE-T)
Fiber Ethernet	IEEE 802.3 (100BASE-FX, 1000BASE-SX/LX)
Wi-Fi	IEEE 802.11 (a/b/g/n/ac/ax)
USB	USB-IF standards
Bluetooth	Bluetooth SIG
DSL	ITU-T G.992 series

Transmission modes:

• Simplex: One direction only. (Broadcast TV)
• Half-duplex: Both directions, not simultaneously. (Walkie-talkie, old hub networks)
• Full-duplex: Both directions simultaneously. (Telephone, modern Ethernet switches)

---

Q10. What is the Data Link layer (Layer 2)? What are its sublayers? Medium

The Data Link layer provides node-to-node data transfer within a network segment. It addresses two sublayers:

Two sublayers (IEEE 802 division):

Sublayer	Name	Function
LLC	Logical Link Control	Interface to Network layer; flow control; error notification
MAC	Media Access Control	Framing; hardware addressing (MAC address); media access control

MAC address: 48-bit hardware address (e.g., AA:BB:CC:DD:EE:FF). First 24 bits: OUI (manufacturer ID). Last 24 bits: device-specific.

Frame structure (Ethernet II):

| Preamble (7B) | SFD (1B) | Dest MAC (6B) | Src MAC (6B) | EtherType (2B) | Payload (46-1500B) | FCS (4B) |

Error detection: FCS (Frame Check Sequence) is a CRC-32 checksum. If corrupted, frame is discarded (NOT retransmitted at Layer 2; that is TCP's job).

Media Access:

• CSMA/CD: (Carrier Sense Multiple Access / Collision Detection) -- used in half-duplex Ethernet. Detect collision, back off randomly, retry.
• CSMA/CA: (Collision Avoidance) -- used in Wi-Fi. Cannot detect collision (hidden node problem), so avoid by using RTS/CTS and random backoff.

---

Q11. What is the Network layer (Layer 3)? What is routing? Medium

The Network layer provides logical addressing and routes packets from source to destination across multiple networks (internetworking).

Key functions:

1. Logical addressing: IP addresses identify hosts globally.
2. Routing: Determining the best path for packets across networks.
3. Packet forwarding: Moving packets hop-by-hop along the route.
4. Fragmentation: Splitting packets to fit the MTU of each link.

Routing vs Forwarding:

• Routing: Building the routing table (which network is reachable via which interface). Done by routing protocols (OSPF, BGP, RIP).
• Forwarding: Using the routing table to determine where to send each packet. Done per packet, very fast (ASIC in hardware).

Routing algorithms:

Type	Approach	Protocols
Distance Vector	Each router knows distance to all networks via its neighbors (Bellman-Ford)	RIP, EIGRP
Link State	Each router knows the complete topology; calculates shortest path (Dijkstra)	OSPF, IS-IS
Path Vector	Like distance vector but stores full path to prevent loops	BGP (internet backbone)

---

Q12. What is the Transport layer (Layer 4)? Medium

The Transport layer provides end-to-end communication services between application processes on different hosts.

Key functions:

Function	Description
Multiplexing/Demultiplexing	Multiple applications use the same IP address; port numbers distinguish them
Segmentation and Reassembly	Large application data split into segments; reassembled at destination
Connection management	TCP: establishes, maintains, terminates connections
Reliability	TCP: sequence numbers, ACKs, retransmission
Flow control	TCP: receiver window prevents buffer overflow
Congestion control	TCP: reduces send rate when network is congested

Protocols: TCP, UDP, SCTP (Stream Control Transmission Protocol -- combines TCP reliability with UDP-like message orientation).

Socket: The interface between the Transport layer and the Application layer. An application opens a socket, specifying the protocol (TCP/UDP) and local port.

---

Q13. What is the difference between a MAC address and an IP address? Easy

Aspect	MAC Address	IP Address
Layer	Data Link (Layer 2)	Network (Layer 3)
Scope	Local network only (not routed)	Global (routed across internet)
Assignment	Burned into hardware by manufacturer	Assigned by DHCP or manually
Format	48 bits: AA:BB:CC:DD:EE:FF (hex)	IPv4: 32 bits (192.168.1.1); IPv6: 128 bits
Permanence	Permanent (can be spoofed in software)	Dynamic (DHCP) or static
Purpose	Delivery within a LAN	Delivery across networks (routing)
Changes on routing	Yes (each hop rewrites source/dest MAC)	No (source/dest IP unchanged end-to-end)

Why both? IP addresses identify hosts globally. But on a local Ethernet network, delivery is done by MAC addresses. ARP translates IP to MAC for local delivery. Routers use IP addresses to route between networks.

---

Q14. How does a switch learn MAC addresses? Medium

A switch builds its MAC address table (CAM table) dynamically through a learning process.

Learning process:

Initially: CAM table is empty.

Step 1: PC-A (MAC: AA:AA) sends a frame to PC-B (MAC: BB:BB)
  Switch receives frame on Port 1.
  Records: AA:AA is on Port 1 (learns source MAC)
  
Step 2: Switch looks up BB:BB in CAM table.
  Not found -> FLOOD: send frame to all ports except Port 1 (the arriving port)
  
Step 3: PC-B replies to PC-A.
  Switch receives reply on Port 3.
  Records: BB:BB is on Port 3 (learns BB's location)
  Looks up AA:AA in CAM table -> found on Port 1.
  Forwards only to Port 1 (no flood).

CAM table now: AA:AA -> Port 1, BB:BB -> Port 3

CAM table aging: Entries expire after inactivity (typically 300 seconds) to remove stale entries (moved devices).

MAC flooding attack: An attacker floods the switch with frames having random source MACs. CAM table fills up (overflow). Switch degrades to hub behavior (floods all frames). Attacker captures all traffic. Mitigation: Port security (limit MACs per port).

---

Q15. What is VLAN (Virtual LAN)? Medium

A VLAN logically separates a physical network into multiple broadcast domains. Devices in different VLANs cannot communicate at Layer 2 without a router (or Layer 3 switch).

Why VLANs:

• Security: HR VLAN and Engineering VLAN are isolated at Layer 2.
• Broadcast control: A broadcast in VLAN 10 (HR) does not reach VLAN 20 (Engineering).
• Flexibility: Devices can be in the same VLAN even if on different physical switches.

IEEE 802.1Q (VLAN tagging): A 4-byte VLAN tag is added to Ethernet frames to carry VLAN information across trunk links (switch-to-switch links carrying multiple VLANs).

Tagged frame:
| Dest MAC | Src MAC | 802.1Q Tag (4B) | EtherType | Payload | FCS |
                      ^^^^^^^^^^^
                      TPID (0x8100) | PCP (3 bits) | DEI (1 bit) | VLAN ID (12 bits)
                      VLAN ID: 0-4094 (12 bits = 4096 VLANs)

Access port: Connects to end devices; untagged frames (device doesn't know about VLANs). Trunk port: Switch-to-switch; tagged frames (carries multiple VLANs).

---

Upper Layers

Q16. What is the Session layer (Layer 5)? Easy

The Session layer manages sessions (logical connections) between applications. It provides:

• Session establishment: Setup of a communication session.
• Session maintenance: Keeping the session alive during long transfers.
• Session termination: Gracefully ending the session.
• Synchronization: Checkpoint insertion for long data transfers (if transfer is interrupted, resume from last checkpoint, not start).
• Dialog control: Half-duplex or full-duplex communication management.

Protocols:

• NetBIOS: Session layer for Windows file sharing.
• RPC (Remote Procedure Call): Session management for distributed applications.
• PPTP (Point-to-Point Tunneling Protocol): VPN session establishment.
• NFS (partly): Session aspects of network file system.

Note: In TCP/IP practice, Session layer functionality is largely handled by the Application or Transport layer (TCP keeps connections alive; HTTP sessions are application-layer). Pure Session layer protocols are rare in modern internet applications.

---

Q17. What is the Presentation layer (Layer 6)? Easy

The Presentation layer acts as a translator, converting data formats so that the Application layer can use them.

Key functions:

Function	Description	Example
Translation	Convert between different data representations	EBCDIC (IBM) to ASCII
Encryption/Decryption	Secure data for transmission	TLS/SSL encryption
Compression/Decompression	Reduce data size for transmission	GZIP, LZ77
Serialization	Convert application objects to transmittable format	JSON, XML, Protocol Buffers

Protocols/Standards:

• SSL/TLS: Encryption (though often called Transport layer security, it technically operates at the Presentation layer in OSI).
• JPEG, PNG, GIF: Image formats.
• MPEG, MP3, MP4: Audio/video formats.
• ASCII, Unicode: Character encoding.

In TCP/IP: Presentation layer functionality is absorbed into the Application layer. HTTP uses GZIP compression; HTTPS uses TLS encryption; both at the Application layer in practice.

---

Q18. What is the Application layer (Layer 7)? Easy

The Application layer is the topmost layer that provides network services directly to user applications.

What it does:

• Defines the interface between user applications (browser, email client) and network services.
• Defines application protocols (rules for how applications communicate).
• Does NOT include the actual user applications (the browser is not part of Layer 7; the HTTP protocol it uses is).

Major Application layer protocols:

Protocol	Port	Function
HTTP	80	Web browsing (request-response)
HTTPS	443	Encrypted web (HTTP over TLS)
FTP	20, 21	File transfer
SMTP	25	Sending email
POP3	110	Receiving email (download + delete)
IMAP	143	Receiving email (sync, leave on server)
DNS	53	Domain name resolution
DHCP	67, 68	Dynamic IP address assignment
SSH	22	Secure shell remote access
SNMP	161	Network device management
NTP	123	Time synchronization

---

Q19. What is DNS? How does DNS resolution work? Medium

DNS (Domain Name System) translates human-readable domain names (google.com) to IP addresses (142.250.195.14).

DNS resolution (recursive query from browser):

1. Browser: "What is the IP of www.google.com?"
2. OS checks local DNS cache. No entry.
3. OS queries Recursive Resolver (set by ISP or 8.8.8.8):
   "What is the IP of www.google.com?"
4. Recursive Resolver checks cache. No entry. Queries Root Nameserver:
   "What nameserver handles .com?"
5. Root Nameserver replies: "Ask the .com TLD nameserver at 192.5.6.30"
6. Recursive Resolver queries .com TLD Nameserver:
   "What nameserver handles google.com?"
7. TLD Nameserver replies: "Ask Google's Authoritative Nameserver at ns1.google.com"
8. Recursive Resolver queries Google's Authoritative Nameserver:
   "What is the IP of www.google.com?"
9. Authoritative Nameserver replies: "142.250.195.14, TTL=300"
10. Recursive Resolver caches the response (for 300 seconds), returns to OS.
11. OS caches and returns to browser.
12. Browser connects to 142.250.195.14.

DNS record types:

Type	Purpose	Example
A	IPv4 address	google.com -> 142.250.195.14
AAAA	IPv6 address	google.com -> 2607:f8b0::200e
CNAME	Alias (canonical name)	www.google.com -> googlecom
MX	Mail server	google.com -> aspmx.l.google.com
NS	Nameserver	google.com -> ns1.google.com
TXT	Text (SPF, DKIM, verification)	v=spf1 include:...
PTR	Reverse DNS (IP to name)	14.195.250.142.in-addr.arpa -> google.com

---

Q20. What is DHCP? How does it work? Medium

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network configuration to devices.

DORA process:

1. DISCOVER: Client broadcasts to 255.255.255.255 (no IP yet):
   "I need an IP address! Is any DHCP server there?"

2. OFFER: DHCP server replies (unicast or broadcast):
   "I offer you 192.168.1.50 with this lease. DNS: 8.8.8.8, Gateway: 192.168.1.1"

3. REQUEST: Client broadcasts (may receive multiple offers):
   "I accept the offer from server 192.168.1.1"
   (broadcasts so other servers know their offer was declined)

4. ACK: DHCP server acknowledges:
   "Confirmed. 192.168.1.50 is yours for 24 hours (lease time)."

Client now has:
  IP: 192.168.1.50
  Subnet mask: 255.255.255.0
  Default gateway: 192.168.1.1
  DNS servers: 8.8.8.8, 8.8.4.4

Lease renewal: At 50% of lease time, client tries to renew with the same server. At 87.5%, tries any server. At expiry, must start DORA again.

---

Q21. What is the difference between HTTP and HTTPS? Easy

Aspect	HTTP	HTTPS
Full name	HyperText Transfer Protocol	HTTP Secure
Security	No encryption	TLS/SSL encryption
Port	80	443
Certificate required	No	Yes (SSL/TLS certificate)
Data in transit	Plaintext (interceptable)	Encrypted (unreadable to MITM)
URL prefix	http://	https://
Performance	Slightly faster (no TLS overhead)	Negligible difference with TLS 1.3 + session resumption
Browser indicator	No lock icon	Lock icon
SEO	No advantage	Google ranking factor (HTTPS preferred)

How HTTPS works:

1. Client connects to server:443 (TCP handshake).
2. TLS handshake:
   a. Client sends supported TLS versions and cipher suites.
   b. Server selects cipher suite, sends certificate (public key).
   c. Client verifies certificate against trusted CAs.
   d. Both derive session keys using Diffie-Hellman key exchange.
3. Encrypted communication begins using symmetric session key.

---

Comparison and Design

Q22. What is the difference between TCP/IP and OSI? Which is used in practice? Easy

Aspect	OSI Model	TCP/IP Model
Layers	7	4
Status	Reference/conceptual model	Practical implementation
Protocol independence	Yes (model is protocol-agnostic)	Designed around TCP, IP protocols
Session/Presentation	Separate layers (5 and 6)	Merged into Application layer
Physical/Data Link	Separate layers (1 and 2)	Merged into Network Access layer
Usage	Education, troubleshooting framework	Actual internet protocols
Standardized by	ISO	IETF (Internet Engineering Task Force)

Used in practice: TCP/IP. The internet runs on TCP/IP protocols. OSI is used as a conceptual framework for teaching and troubleshooting, not as an actual protocol suite implementation.

---

Q23. At which layer does a router operate? Explain with packet flow. Medium

A router operates primarily at Layer 3 (Network layer) and also processes Layer 1 and Layer 2 for physical reception.

Packet forwarding at a router:

Incoming frame on interface eth0:
1. Layer 1 (Physical): receive electrical signals, convert to bits.
2. Layer 2 (Data Link): check Ethernet FCS (CRC). If corrupt, DROP.
   Strip Ethernet header. Check destination MAC = router's MAC. OK.
3. Layer 3 (Network): read IP header. Check TTL (decrement by 1).
   If TTL=0, DROP and send ICMP Time Exceeded.
   Look up destination IP in routing table.
   Find: "192.168.2.0/24 is reachable via 10.0.0.2 on interface eth1"
4. Layer 2 (Data Link): create new Ethernet frame:
   Source MAC = router's eth1 MAC
   Dest MAC = ARP lookup for 10.0.0.2 (or next hop)
5. Layer 1 (Physical): transmit frame on eth1.

Key observation: The router does NOT process Layers 4-7. It reads only the IP header (Layer 3). This is why NAT firewalls (which inspect ports = Layer 4) are "Layer 4 devices."

---

Q24. What is the difference between a hub, switch, and router? Easy

Device	Layer	Intelligence	Broadcast domain	Collision domain
Hub	Layer 1	None (repeats to all)	One (shared)	One (all devices)
Switch	Layer 2	MAC table (forwards to correct port)	One per VLAN	One per port
Router	Layer 3	Routing table (routes by IP)	Separates broadcast domains	N/A

Hub: All devices share bandwidth. One collision domain. Half-duplex. Obsolete.

Switch: Each port is its own collision domain (full-duplex). All ports in same VLAN share one broadcast domain.

Router: Separates broadcast domains (each interface is a different subnet). Forwards between subnets based on IP. Connects LAN to WAN (internet).

Analogy:

• Hub: Party line phone (everyone hears everyone).
• Switch: Private extensions (direct connection).
• Router: Post office (routes to different cities/subnets).

---

Q25. What are common network troubleshooting tools and which OSI layer do they address? Medium

Tool	Command	Layer(s)	What it checks
ping	ping 8.8.8.8	3 (ICMP)	Basic IP connectivity, RTT
traceroute/tracert	traceroute 8.8.8.8	3 (ICMP)	Hop-by-hop path, latency per hop
netstat	netstat -an	4 (TCP/UDP)	Active connections and listening ports
nslookup/dig	dig google.com	7 (DNS)	DNS resolution
nmap	nmap -sS 192.168.1.1	3-4	Port scanning, service detection
tcpdump/Wireshark	tcpdump -i eth0	2-7	Packet capture and analysis
ifconfig/ip	ip addr show	2-3	Interface config, MAC, IP
arp	arp -a	2-3 (ARP)	ARP cache, MAC-IP mappings
mtr	mtr 8.8.8.8	3	Combined ping+traceroute
curl	curl -v http://...	7 (HTTP)	HTTP request/response

Troubleshooting approach (bottom-up):

1. Check Layer 1: Is the cable plugged in? Link light on?
2. Check Layer 2: Does the switch show the MAC in its CAM table?
3. Check Layer 3: Can you ping the default gateway?
4. Check Layer 4: Is the service listening on the correct port (netstat)?
5. Check Layer 7: Does the application respond correctly (curl, telnet to port)?

---

Q26. What is a subnet and how does subnetting relate to the OSI model? Medium

A subnet is a logical subdivision of an IP network. Devices in the same subnet can communicate directly at Layer 2 (without routing).

Subnetting fundamentals:

IP address: 192.168.1.50
Subnet mask: /24 (255.255.255.0)

Network address: 192.168.1.0  (first address)
Broadcast: 192.168.1.255       (last address)
Usable hosts: 192.168.1.1 to 192.168.1.254  (254 hosts)

CIDR notation: /24 means 24 bits for network prefix, 8 bits for host portion.

/24 -> 256 addresses, 254 hosts
/25 -> 128 addresses, 126 hosts
/26 -> 64 addresses, 62 hosts
/30 -> 4 addresses, 2 hosts (point-to-point links)

OSI layer relationship:

• Subnetting is a Layer 3 (Network layer) concept.
• Devices within a subnet communicate at Layer 2 (switch forwards by MAC, ARP resolves IP to MAC).
• Communication between subnets requires a router (Layer 3).

Why subnet?

• Limit broadcast domain size (fewer devices hear each broadcast).
• Security: isolate segments (HR subnet from Engineering subnet).
• IP address management: allocate appropriate-sized subnets.

---

FAQ

Q: What does "Layer 7 load balancer" mean? A Layer 7 load balancer (Application layer) can inspect HTTP headers, cookies, and URLs to make routing decisions. It can route requests to different backend servers based on the URL path (/api/* to one pool, /static/* to another) or user session. A Layer 4 load balancer only looks at TCP/IP headers (IP, port), faster but less intelligent.

Q: What happens if a switch does not know the destination MAC? The switch floods the frame to all ports in the VLAN except the incoming port. This is called a "unknown unicast flood." When the destination device responds, the switch learns its MAC and port.

Q: Can a Wi-Fi access point be considered a Layer 2 device? Yes. An access point (AP) operates at Layer 2, forwarding frames between wireless clients and the wired network. It translates between 802.11 (Wi-Fi) frames and 802.3 (Ethernet) frames. It does not route (that is the router's job).

---

Related PapersAdda guides:

• TCP/IP Interview Questions 2026
• HTTP HTTPS DNS Questions 2026
• Subnetting Interview Questions 2026
• Computer Networks Interview Questions 2026
• OS Interview Questions 2026