Network Engineer interview questions and answers

From the bottom: 1 Physical, the cables, fibre, signals and hubs; 2 Data Link, Ethernet frames, MAC addresses and switches; 3 Network, IP addressing and routing, with routers and ICMP; 4 Transport, TCP and UDP, with port numbers; 5 Session, which sets up and ends conversations; 6 Presentation, data formats, encoding and encryption; 7 Application, protocols such as HTTP, DNS, SMTP and SSH.

The TCP/IP model is what the internet actually uses, with four layers: Network Access (OSI 1 and 2), Internet (3), Transport (4) and Application (5 to 7). Mention why it matters: when troubleshooting you start at layer 1, checking the cable and link lights, and work upwards.

Encapsulation means each layer wraps the data from the layer above with its own header. The application's data gets a TCP or UDP header with source and destination ports, making a segment. Then an IP header with source and destination IP addresses and a TTL, making a packet. Then an Ethernet header with source and destination MAC addresses, plus a trailer with a checksum (FCS), making a frame, which is sent as bits. The receiver removes the headers in reverse order.

At each router, the frame's MAC addresses are replaced for the next link and the TTL drops by one, but the source and destination IPs stay the same, unless NAT changes them. Interviewers often ask exactly this follow-up.

ARP, Address Resolution Protocol, finds the MAC address that belongs to an IP address on the local network. A device broadcasts "who has 192.168.1.1?", the owner replies with its MAC address by unicast, and the answer is cached in the ARP table (arp -a on Windows, show ip arp on a Cisco router).

The PC first uses its subnet mask to compare the destination IP with its own network. If the destination is on another subnet, the PC doesn't ARP for the destination at all: it ARPs for its default gateway and sends the frame to the gateway's MAC address, while the IP header still carries the final destination's IP. A wrong default gateway or subnet mask is a common reason a PC reaches local devices but nothing else.

SSH is TCP 22 and Telnet TCP 23; Telnet sends everything in clear text, so use SSH. DNS is port 53, mainly UDP for queries, with TCP for zone transfers and large responses. DHCP is UDP, 67 on the server and 68 on the client. HTTP is TCP 80 and HTTPS TCP 443 (HTTP/3 runs over UDP 443). SNMP is UDP 161 for polling and 162 for traps. Syslog is UDP 514 by default.

Interviewers often add a few more: FTP 20 and 21, SMTP 25, NTP UDP 123, RDP 3389 and BGP TCP 179. Learn them with the reason behind TCP or UDP: protocols that need reliable delivery use TCP, quick query-reply protocols use UDP.

The client sends SYN with its starting sequence number, the server replies SYN-ACK with its own sequence number and an acknowledgement, and the client sends ACK. Only then does data flow. A server that isn't listening on that port replies with RST instead, which the client shows as "connection refused".

Repeated SYNs with no reply mean the SYN, or the reply, is being lost. Common causes: a firewall or ACL dropping the traffic silently, the server being down or unreachable, a missing route back to the client, or asymmetric routing where a stateful firewall sees only one direction. Capture on the server side too: if the SYN arrives there and the SYN-ACK leaves, the problem is on the return path.

A static route is configured by hand, such as ip route 10.20.0.0 255.255.0.0 192.168.1.2. It uses no CPU or bandwidth for updates, but it doesn't react if a link fails. Dynamic routing protocols, like OSPF, EIGRP and BGP, let routers exchange routes and recalculate paths automatically when the network changes, which is what larger networks need.

Static routes are still common in three places: a default route to the ISP, ip route 0.0.0.0 0.0.0.0 followed by the ISP's next hop; small branch or stub networks with only one way out; and a floating static route, given a higher administrative distance, such as 250, so it's used only as a backup when the dynamic route disappears.

First comes longest prefix match: when forwarding, the router uses the most specific matching route, so a /24 beats a /16 regardless of where they came from. When two sources offer the same prefix, the one with the lowest administrative distance goes into the routing table. Cisco's defaults: connected 0, static 1, eBGP 20, internal EIGRP 90, OSPF 110, RIP 120, external EIGRP 170 and iBGP 200.

So between OSPF and EIGRP for the same prefix, the internal EIGRP route wins with 90. Within one protocol, the lowest metric decides: cost for OSPF, a composite of bandwidth and delay for EIGRP. Check with show ip route, where each entry shows [distance/metric].

Start with show ip ospf neighbor and show ip ospf interface on both sides. To form an adjacency, these must match: area ID, subnet and mask on the link, hello and dead timers (10 and 40 seconds by default on Ethernet), authentication type and key, and area type, such as both stub. Router IDs must be unique, and the interface mustn't be passive.

The state where it's stuck gives a clue. Stuck in INIT means hellos arrive in only one direction, often an ACL or a one-way link. Stuck in EXSTART or EXCHANGE usually means an MTU mismatch. Remember that on a broadcast segment, two routers that are neither DR nor BDR normally stay in 2-WAY with each other; that's correct, not a fault.

BGP is the routing protocol between autonomous systems, the one the internet runs on. Companies use it to connect to two ISPs with their own public prefix, so the network stays reachable if one ISP fails. It runs over TCP port 179 and chooses paths by attributes rather than a simple metric.

For outbound traffic, set a higher local preference (the default is 100) on routes from the preferred ISP; it applies across your own routers. Inbound is harder, because the rest of the internet decides. Options: AS-path prepending, adding your AS number several times on the backup link so that path looks longer; advertising more specific prefixes on the preferred link; and BGP communities the ISP supports. MED can also influence a neighbour with several links to you.

A VLAN splits one physical switch into separate broadcast domains, so, for example, finance, staff and guest devices are on different networks and must go through a router or firewall to talk. An access port belongs to one VLAN and carries untagged frames, for an end device like a PC or printer: switchport mode access and switchport access vlan 10.

A trunk carries many VLANs between switches, or to a router, by adding an 802.1Q tag with the VLAN ID to each frame: switchport mode trunk and switchport trunk allowed vlan 10,20,30. Frames in the native VLAN cross the trunk untagged, so the native VLAN must match on both ends; changing it from VLAN 1 to an unused VLAN is good security practice.

When a frame arrives, the switch records its source MAC address and the port it came in on in its MAC address table. Then it looks up the destination MAC: if it's in the table, it forwards the frame only out of that port. If the destination is unknown, or the frame is a broadcast, it floods it out of every port in that VLAN except the one it came from. When the reply comes back, the switch learns that address too. Entries age out after 300 seconds of silence by default on Cisco switches.

View the table with show mac address-table. Mention the risk: an attacker can flood fake MAC addresses to fill the table, which port security limits.

Redundant links between switches create loops, and Ethernet frames have no TTL, so broadcasts circle forever: a broadcast storm that can bring a network down in seconds. STP blocks the extra links and keeps them as backups. The switch with the lowest bridge ID becomes root: priority first (default 32768, plus the VLAN number in per-VLAN STP), then the lowest MAC address. Each other switch picks its root port, the lowest-cost path to the root, and each link gets one designated port; the rest block.

Never leave the root to chance: set it on the core with spanning-tree vlan 10 root primary. On access ports, enable PortFast with BPDU Guard, so a port that receives a BPDU shuts down (err-disabled). Prefer Rapid PVST+ for fast convergence.

Devices in different VLANs need a router. With router-on-a-stick, one router interface connects to a trunk and has a subinterface per VLAN: interface g0/0.10, encapsulation dot1Q 10, ip address 192.168.10.1 255.255.255.0, and the same for each VLAN. It's cheap and fine for a small office, but all routed traffic shares that single link and the router's capacity.

On a Layer 3 switch you enable ip routing and create a switched virtual interface per VLAN, such as interface vlan 10 with its IP address, which becomes that VLAN's default gateway. Routing happens in hardware at wire speed, so it's the normal choice for a campus distribution or core layer. Either way, each host's default gateway must be its VLAN's interface address.

Run show etherchannel summary first: it shows each member port's flag, such as P for bundled, s for suspended or I for stand-alone. Then check the negotiation modes. With LACP, at least one side must be active; passive on both ends never forms. With PAgP, at least one side must be desirable; and on must face on, since it doesn't negotiate.

Every member port must match: speed, duplex, access VLAN or trunk mode, allowed VLANs and native VLAN. A single mismatched port is suspended. Mention a common misunderstanding: EtherChannel balances per flow using a hash of addresses, so one large file transfer still uses only one link's speed; the extra capacity shows across many flows.

Four subnets need 2 borrowed bits, so the prefix becomes /26, mask 255.255.255.192. That leaves 6 host bits: 64 addresses per subnet, 62 usable after the network and broadcast addresses. The block size is 64.

So: 192.168.10.0/26 has hosts .1 to .62, broadcast .63. 192.168.10.64/26 has hosts .65 to .126, broadcast .127. 192.168.10.128/26 has hosts .129 to .190, broadcast .191. 192.168.10.192/26 has hosts .193 to .254, broadcast .255.

Show your method aloud: hosts per subnet is 2 to the power of the host bits, minus 2. Interviewers care about a reliable method more than speed.

Classes come from the first octet: A is 1 to 126 with a default /8 mask (127 is kept for loopback), B is 128 to 191 with /16, C is 192 to 223 with /24, D is 224 to 239 for multicast, and E, 240 to 255, is reserved. Today networks use CIDR, so any prefix length is allowed and classes are mainly background knowledge.

The private ranges from RFC 1918 are 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. They aren't routed on the internet, so they reach it through NAT. Also mention 169.254.0.0/16: a PC with one of these addresses gave itself one because it couldn't reach a DHCP server.

IPv4 addresses are 32 bits, written as four decimal numbers. IPv6 addresses are 128 bits, written as eight groups of four hex digits separated by colons. You can drop leading zeros in a group and replace one run of all-zero groups with ::, so 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. IPv6 has no broadcast, using multicast instead, and Neighbor Discovery replaces ARP. Hosts can configure their own address with SLAAC. A LAN is normally a /64.

A link-local address, from fe80::/10, is created automatically on every IPv6 interface and works only on that link. Routers use it for neighbour messages and as the next hop. Global addresses currently come from 2000::/3, and ::1 is loopback.

Allocate the largest first, so the blocks line up. 100 hosts need 7 host bits (126 usable): 172.16.0.0/25, hosts .1 to .126. 50 hosts need 6 bits (62 usable): 172.16.0.128/26, hosts .129 to .190. 20 hosts need 5 bits (30 usable): 172.16.0.192/27, hosts .193 to .222. Each WAN link needs 2 addresses, so a /30: 172.16.0.224/30 with .225 and .226, and 172.16.0.228/30 with .229 and .230.

That leaves 172.16.0.232 to .255 free for growth. Mention that many routers support /31 on point-to-point links, which uses only two addresses per link, and always note the growth expected before choosing sizes.

A standard ACL, numbered 1 to 99 or 1300 to 1999, matches only the source IP address, so apply it close to the destination; otherwise it blocks that source from everything. An extended ACL, 100 to 199 or 2000 to 2699, matches source and destination, protocol and port, so apply it close to the source to drop unwanted traffic early.

Example: access-list 110 deny tcp 192.168.10.0 0.0.0.255 host 10.1.1.10 eq 23, then access-list 110 permit ip any any, applied with ip access-group 110 in on the interface. Rules are checked top to bottom, the first match wins, and every ACL ends with an implicit deny, which is why the permit line matters. Note the wildcard mask, 0.0.0.255.

Static NAT maps one private address to one public address permanently, used to publish an internal server. Dynamic NAT maps private addresses to a pool of public addresses, first come first served, and runs out when the pool is used. PAT, also called NAT overload, lets many private addresses share one public address by tracking each connection's source port. That is what almost every home and office internet connection uses.

On a Cisco router: mark ip nat inside and ip nat outside on the interfaces, then ip nat inside source list 1 interface g0/1 overload. Check with show ip nat translations. Mention that NAT hides internal addresses but isn't a security control by itself; the firewall rules are.

Both ends need matching settings. Phase 1, IKE (IKEv2 preferred), authenticates the peers with a pre-shared key or certificates and agrees encryption, integrity, Diffie-Hellman group and lifetime. Phase 2 creates the IPsec security associations for ESP and defines the traffic to protect: the local and remote subnets, which must mirror each other on the two sides.

If it fails: check the peers reach each other's public IPs and that UDP 500, UDP 4500 (NAT traversal) and ESP, IP protocol 50, are allowed. Compare proposals, keys and phase 2 subnets. Make sure the VPN traffic is exempted from NAT, and that routes point into the tunnel. On Cisco, show crypto isakmp sa and show crypto ipsec sa, whose encrypt and decrypt counters show whether traffic flows each way.

Work up the layers and narrow it down quickly. First, is it one user or many? Many points to the network or ISP; one points to that device. On the PC: check the cable or Wi-Fi connection, then ipconfig. An address starting 169.254 means DHCP failed. Then ping the default gateway; if that fails, the problem is local: the switch port, VLAN or Wi-Fi. If the gateway replies, ping a public IP such as 8.8.8.8, which tests routing and NAT to the internet.

If the IP works but websites don't, test DNS with nslookup. If DNS works too, look at the proxy, the browser or that one site. Write down each result, and tell the user what you found in plain words.

Traceroute sends packets with a TTL of 1, then 2, then 3, and so on. Each router that reduces a packet's TTL to zero drops it and sends back an ICMP Time Exceeded message, which reveals that hop's address and the round-trip time. It stops when the destination replies. Windows tracert uses ICMP echo requests; traceroute on Linux and Cisco uses UDP to high ports by default.

An asterisk means no reply arrived in time for that probe. Often a router simply rate-limits or doesn't send ICMP replies, which isn't a problem if later hops answer. Stars from some hop all the way to the end mean traffic is filtered or the path breaks there. Mention that the return path can differ from the outbound path.

Capture at the client, or on a SPAN port, while reproducing the problem, and filter to the conversation, for example ip.addr == 10.1.1.20 && tcp.port == 443. The time between SYN and SYN-ACK is roughly the network round trip. Then compare it with the time between the client's request and the server's first response: if the handshake is quick but the response takes seconds, the server or application is slow, not the network.

Signs of a network problem are retransmissions and duplicate ACKs (filter with tcp.analysis.flags), which point to packet loss; then check interface errors along the path. A TCP zero window means the receiver can't keep up. Statistics, Conversations and the IO graph help show it to others.

The access layer connects end devices: PCs, phones, printers and wireless access points. It provides ports, PoE, VLAN assignment and port security. The distribution layer aggregates the access switches. It routes between VLANs, applies policy such as ACLs, and provides redundant gateways with HSRP or VRRP. The core layer is a fast, highly available backbone joining the distribution blocks, the data centre and the WAN, kept simple and free of heavy policy.

The benefits are easier growth, faults contained within a block, and predictable traffic paths. Mention that small and medium sites often use a collapsed core, where one pair of switches does both distribution and core.

Plan so that routes can be summarised and the scheme is easy to read. For example, give the head office 10.0.0.0/16 and keep 10.1.0.0/16 for branches, with a /22 for each branch: 10.1.0.0/22 for the first, 10.1.4.0/22 for the second, and so on. That fits 64 branches, and the head office can reach all of them with one summary route. Inside each /22, use one /24 for each purpose: users, voice, guest Wi-Fi, and management.

Avoid 192.168.0.0/24 and 192.168.1.0/24, which home routers use and which break remote-access VPNs. Leave room for growth, use the same layout at every branch, and record everything in an IP address management tool or sheet.

I'd ask first about growth, applications and the budget. A typical design: access switches with PoE for phones and access points, each with two uplinks to a pair of core switches (a collapsed core), running inter-VLAN routing with HSRP or VRRP for the gateways. Separate VLANs for users, voice, servers, printers, management and guests.

At the edge, a pair of firewalls with two ISP links for failover, and a DMZ for anything reachable from the internet. Guest Wi-Fi goes straight to the internet, isolated from internal VLANs. Servers sit in their own VLAN behind firewall rules. Add a management network, NTP, central logging and SNMP monitoring, and document the IP plan. Size uplinks for expected traffic.

Keep it to about a minute and steer it towards networking. Present, past, future: "I'm a [degree] graduate from [college], and I've been focused on networking for the last [time]. I've completed [CCNA or course] and practise in [Packet Tracer, GNS3 or a home lab], where I built [lab, such as a multi-VLAN network with OSPF and a site-to-site VPN]. During [internship or project], I [what you did, such as helped set up switches for a college lab]. I'm looking for a network engineer role where I can work on real routing, switching and security."

Be ready for detailed questions on anything you mention, especially your lab.

Many network roles in India start in a network operations centre or with field visits, so expect this. Answer honestly and show you understand why: "Yes. Networks must be watched around the clock, and I see the NOC as a good place to learn quickly, since you see many kinds of problems. I'm comfortable with rotating shifts and with travelling to sites when needed."

If you have a real constraint, such as a family responsibility, mention it politely and ask how the rotation works. Don't agree to everything and then refuse later; that damages trust more.

Use STAR and show a calm, ordered method. For example: "At 10 a.m. a branch with 80 users lost access to head office (situation). I was the engineer on shift (task). I confirmed the scope from monitoring, found the primary MPLS link down, and saw the backup VPN hadn't taken over because a recent change had removed its route. I restored the route, users were back in 25 minutes, and I kept the branch manager updated every 10 minutes (action). Afterwards I added a monthly failover test to our checklist (result)."

Show both the technical fix and the communication; interviewers look for both.

Use plain words, focus on what it means for them, and say what happens next. Structure: what happened, what it affects, when it will be fixed, and what they can do meanwhile. For example: "The line from our office to the internet provider is down. Email and websites won't work, but files on the office server still will. The provider has promised an engineer by 2 p.m., and I'll update you at noon. Meanwhile you can use the mobile hotspot at reception."

Avoid jargon like "BGP session down". Show you understand the business impact and give realistic times, not promises.

Give a positive reason for networking, not a negative one about coding. For example: "I enjoy seeing how systems connect and finding exactly where something breaks; when I fixed [a lab or real problem], I liked the step-by-step method. Networking is also the base for cloud and security, which I'd like to grow into. I still script small tasks in Python to automate checks, because I think network engineers who can automate are more useful."

Don't say you chose networking because you find coding hard; mentioning some automation interest is a plus, since many networks are now configured with scripts.