20 Linux Networking Interview Questions and Answers for 2026

Most people walk into a networking interview after memorizing definitions, but that’s usually not enough. Interviewers often move beyond questions like, “What is DNS?” and ask practical ones such as, “A user says the website is down, but you can ping the server’s IP address. What would you check next?” The first tests what you remember, while the second shows whether you know how to troubleshoot a real problem.

I’ve put together 20 networking interview questions that are commonly asked for Linux System Administrator, DevOps, and technical support roles. The answers are written in a simple, natural way, just as you’d explain them in an interview. They’re short enough to answer in under a minute, while still giving you enough detail to confidently handle follow-up questions.

1. What is a Computer Network?

A computer network is simply a group of devices connected so they can communicate and share data. These devices can be computers, servers, phones, printers, or even virtual machines.

The communication happens using standard protocols like TCP/IP, which define how data is sent and received. Instead of sending data as one large block, it’s broken into small packets, transmitted across the network, and then reassembled at the destination.

A good real-world example is a company network where employees can access shared files, printers, and internet services through the same network.

2. What’s the Difference Between the OSI Model and the TCP/IP Model?

The OSI model is a conceptual model with 7 layers that’s mainly used to understand how network communication works and to troubleshoot problems. The TCP/IP model has 4 layers and is the model the internet actually uses.

The biggest difference is that the OSI model separates communication into more layers, while the TCP/IP model combines some of them.

For example, the Session, Presentation, and Application layers in OSI are grouped into a single Application layer in TCP/IP.

In interviews, the OSI model is especially useful because it helps you identify where a problem is happening. For example:

• Layer 1 (Physical): Cable unplugged, damaged NIC, or no link light.
• Layer 2 (Data Link): MAC addresses, switches, VLANs, and ARP issues.
• Layer 3 (Network): IP addressing, routing, routers, and ICMP.
• Layer 4 (Transport): TCP, UDP, port numbers, and connections.
• Layer 7 (Application): Services like HTTP, DNS, SSH, and SMTP.

So, I think of the OSI model as a troubleshooting guide, while the TCP/IP model is what real networks use every day.

3. What is DNS, and What Happens During a DNS lookup?

DNS (Domain Name System) is like the internet’s phonebook. It translates a domain name, such as google.com, into an IP address that computers use to communicate.

When you enter a website address in your browser, your computer first checks whether it already knows the IP address from its local cache. If not, it sends the request to a DNS resolver.

The resolver contacts other DNS servers until it finds the authoritative server for that domain, retrieves the correct IP address, caches the result for a period defined by the TTL (Time to Live), and returns it to your computer. Your browser then uses that IP address to connect to the website.

Some common DNS record types are:

• A – Maps a domain name to an IPv4 address.
• AAAA – Maps a domain name to an IPv6 address.
• CNAME – Creates an alias that points one domain name to another.
• MX – Specifies the mail server responsible for receiving emails.
• TXT – Stores text information, commonly used for SPF, DKIM, and domain verification.
• NS – Identifies the authoritative name servers for a domain.
• PTR – Maps an IP address back to a domain name for reverse DNS lookups.

If I need to troubleshoot DNS on Linux, I’d typically use commands like dig, nslookup, or host to verify that a domain resolves correctly and to inspect its DNS records.

4. What Are IPv4 and IPv6, and Why Does IPv6 Exist?

IPv4 and IPv6 are two versions of the Internet Protocol used to identify devices on a network.

IPv4 uses 32-bit addresses, which are written as four numbers separated by dots, such as 192.168.1.10. It provides about 4.3 billion unique addresses, but with the rapid growth of internet-connected devices, those addresses have largely been exhausted.

To solve this problem, IPv6 was introduced. It uses 128-bit addresses, written in hexadecimal and separated by colons, such as 2001:db8::1. This provides an enormous number of unique addresses, enough to support the continued growth of the internet for the foreseeable future.

Besides offering a much larger address space, IPv6 also improves routing efficiency, supports automatic address configuration, and was designed with modern networking in mind.

Today, both IPv4 and IPv6 are widely used. Many networks run in dual-stack mode, which means they support both protocols while the transition from IPv4 to IPv6 continues.

5. What is a Subnet Mask, and What Does /24 Mean?

A subnet mask divides an IP address into two parts: the network portion and the host portion. Devices that have the same network portion can communicate directly, while traffic to other networks must go through a router.

The /24 notation is called CIDR notation. It means the first 24 bits are used for the network, which is the same as the subnet mask 255.255.255.0. That leaves 8 bits for host addresses, giving 256 total addresses, with 254 usable for devices.

A few subnet sizes that are commonly asked in interviews are:

• /30 – 2 usable host addresses.
• /29 – 6 usable host addresses.
• /26 – 62 usable host addresses.
• /24 – 254 usable host addresses.

Whenever I see /24, I immediately know it’s equivalent to 255.255.255.0 and supports up to 254 devices on that subnet.

6. What are Private IP addresses, and What is NAT?

Private IP addresses are IP addresses used inside local networks, such as homes and offices. They aren’t routable on the public internet, so the same private address ranges can be reused by millions of different networks.

The three private IPv4 ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

You’ll also come across 169.254.x.x addresses, which are link-local addresses. A device usually assigns itself one of these if it can’t get an IP address from a DHCP server.

To allow devices with private IP addresses to access the internet, routers use NAT (Network Address Translation). NAT replaces the private source IP address with the router’s public IP address before sending traffic to the internet.

When the response comes back, the router uses its translation table to send the traffic to the correct device on the local network. In most home and office networks, many devices share a single public IP address using a form of NAT called PAT (Port Address Translation).

7. What’s the Difference Between TCP and UDP?

TCP and UDP are both transport layer protocols, but they work differently.

TCP is connection-oriented and reliable. Before sending data, it establishes a connection, makes sure packets arrive in the correct order, retransmits any lost packets, and checks for errors. Because of these features, it’s used when reliable communication is important.

UDP is connectionless. It sends data without establishing a connection or waiting for acknowledgements, so it’s much faster but doesn’t guarantee delivery or packet order.

Some common examples are:

• TCP: HTTP, HTTPS, SSH, FTP, SMTP, and database connections.
• UDP: DNS, DHCP, SNMP, VoIP, online gaming, and live video streaming.

A good example is loading a website. Traditional HTTP and HTTPS use TCP because all the data must arrive correctly. However, HTTP/3 uses QUIC, which runs over UDP while still providing reliable communication, making connections faster and reducing latency.

8. Explain the TCP three-Way Handshake.

The TCP three-way handshake is the process used to establish a reliable connection before any data is exchanged.

It happens in three steps:

• The client sends a SYN packet to the server to request a connection.
• The server replies with a SYN-ACK, acknowledging the client’s request and sending its own synchronization request.
• The client responds with an ACK, confirming the server’s response.

Once these three steps are complete, the connection is established, and data can be transferred reliably between the client and the server. The sequence is easy to remember: SYN → SYN-ACK → ACK.

9. What is DHCP, and How does it Work?

DHCP (Dynamic Host Configuration Protocol) automatically assigns network settings to devices, so you don’t have to configure them manually.

When a device joins a network, it follows a four-step process called DORA:

• Discover – The client broadcasts a request looking for a DHCP server.
• Offer – The DHCP server offers an available IP address.
• Request – The client requests to use the offered IP address.
• Acknowledge – The server confirms the assignment and sends the network configuration.

Along with the IP address, DHCP also provides the subnet mask, default gateway, DNS server addresses, and a lease time. If DHCP isn’t available, many operating systems assign themselves a 169.254.x.x address, which usually indicates the device couldn’t reach a DHCP server.

10. What’s the Difference Between a Hub, a Switch, and a Router?

A hub, switch, and router all connect devices, but they work at different layers and serve different purposes.

A hub works at the Physical Layer (Layer 1). It simply repeats incoming data to every connected device, regardless of the destination, because of this, hubs are inefficient and are rarely used today.

A switch works at the Data Link Layer (Layer 2). It learns the MAC address of each connected device and forwards data only to the correct destination making communication much faster and more efficient than a hub.

A router works at the Network Layer (Layer 3). It connects different networks together and forwards packets based on IP addresses. Home routers also commonly perform NAT, allowing multiple devices on a private network to share a single public IP address.

In simple terms, a hub broadcasts to everyone, a switch sends data to the correct device, and a router connects different networks together.

11. What is a Default Gateway, and How do you Read a Routing Table?

A default gateway is the router a device uses to reach networks outside its own local network. If the destination isn’t on the local subnet, the packet is sent to the default gateway, which forwards it to the next network.

For example, if my computer is on the 192.168.1.0/24 network and I want to reach 8.8.8.8, the packet is sent to the default gateway because that address isn’t on my local network.

On Linux, I can view the routing table using the ip route command. The routing table shows which routes the system knows about and where packets should be sent. If there are multiple matching routes, Linux chooses the most specific route first, and if no specific route matches, it uses the default route.

12. What is ARP?

ARP (Address Resolution Protocol) is used to find the MAC address of a device when its IPv4 address is already known.

When a computer wants to communicate with another device on the same local network, it broadcasts an ARP request asking, ‘Who has this IP address?‘ The device with that IP replies with its MAC address, allowing the sender to build the Ethernet frame and send the data.

To avoid sending ARP requests repeatedly, the operating system stores the results in an ARP cache, which you can view on Linux using the ip neigh command.

It’s also worth remembering that ARP is only used with IPv4. IPv6 uses Neighbor Discovery Protocol (NDP) instead.

13. What are SMTP, POP3, and IMAP?

SMTP, POP3, and IMAP are email protocols, but they serve different purposes.

SMTP (Simple Mail Transfer Protocol) is used to send emails. Email clients use SMTP to send messages to a mail server, and mail servers use it to relay messages to other mail servers.

POP3 (Post Office Protocol version 3) is used to receive emails by downloading them from the mail server to a device. Traditionally, emails are removed from the server after they’re downloaded, making POP3 suitable for using email on a single device.

IMAP (Internet Message Access Protocol) is also used to receive emails, but it keeps messages on the mail server and synchronizes them across multiple devices. That’s why most modern email services use IMAP, since people access their email from phones, laptops, and tablets.

In short, SMTP sends email, while POP3 and IMAP receive email. The main difference is that POP3 downloads mail, whereas IMAP keeps it synchronized across devices.

14. What’s the Difference Between HTTP and HTTPS?

HTTP and HTTPS are both protocols used to transfer web pages between a browser and a web server.

The main difference is security. HTTP sends data in plain text, so anyone intercepting the traffic could potentially read or modify it.

HTTPS is HTTP protected by TLS (Transport Layer Security). It encrypts the communication between the browser and the server, verifies the server’s identity using a digital certificate, and helps ensure that the data isn’t altered during transmission.

HTTP typically uses port 80, while HTTPS uses port 443. Today, almost every website uses HTTPS because it protects user data and is considered the standard for secure web communication.

15. Explain PAN, LAN, WLAN, MAN, WAN, and SAN.

These terms describe networks based on their size or purpose.

• PAN (Personal Area Network) connects devices around one person, such as a phone connected to wireless earbuds over Bluetooth.
• LAN (Local Area Network) connects devices within a small area, like a home, office, or school.
• WLAN (Wireless Local Area Network) is simply a LAN that uses Wi-Fi instead of Ethernet cables.
• MAN (Metropolitan Area Network) connects multiple LANs across a city or a large campus.
• WAN (Wide Area Network) connects networks over large geographic areas, such as different cities or countries. The internet is the largest example of a WAN.
• SAN (Storage Area Network) is a dedicated high-speed network that connects servers to shared storage devices, commonly found in data centers.

An easy way to remember them is: PAN is personal, LAN is local, WLAN is wireless LAN, MAN covers a city, WAN covers long distances, and SAN is designed specifically for storage.

16. When do you Need a Crossover Cable?

A crossover cable was traditionally used to connect two similar devices directly, such as computer-to-computer or switch-to-switch, because it swaps the transmit and receive wires.

However, on modern networks, you almost never need one. Most network devices support Auto-MDI-X, which automatically detects the cable type and adjusts the connection. This means a standard straight-through Ethernet cable works in almost all situations.

Today, you’d only need a crossover cable when working with older 10/100 Mbps devices that don’t support Auto-MDI-X.

17. What’s the Difference Between Bandwidth, Throughput, and Latency?

These three terms describe different aspects of network performance.

Bandwidth is the maximum amount of data a network connection can carry. For example, a 1 Gbps network link has a maximum bandwidth of 1 gigabit per second.

Throughput is the actual amount of data that is successfully transferred. It’s usually lower than the available bandwidth because of factors like network congestion, protocol overhead, and packet retransmissions.

Latency is the time it takes for data to travel from the source to the destination and back. It’s commonly measured in milliseconds using tools like ping.

A common interview question is whether increasing bandwidth reduces latency. The answer is not necessarily. A faster link can transfer more data, but it doesn’t significantly reduce the time it takes for a packet to travel across the network.

That’s why a long-distance connection can still have high latency, even on a very fast internet link.

18. What is a MAC Address?

A MAC (Media Access Control) address is a unique identifier assigned to a network interface. It works at the Data Link Layer (Layer 2) and is used for communication between devices on the same local network.

A MAC address is 48 bits long and is usually written as six pairs of hexadecimal numbers, for example, 00:1A:2B:3C:4D:5E.

When a switch forwards data on a local network, it uses MAC addresses, while routers use IP addresses to forward traffic between different networks.

Although MAC addresses are assigned by the manufacturer, modern operating systems can temporarily change or randomize them for privacy reasons, especially on Wi-Fi networks.

19. How do you Measure Network Reliability?

Network reliability is measured by how consistently a network stays available and how quickly it recovers from failures.

Some common metrics are:

• Availability – The percentage of time the network is operational, such as 99.9% or 99.99% uptime.
• MTBF (Mean Time Between Failures) – The average time a system operates before a failure occurs.
• MTTR (Mean Time To Repair) – The average time required to restore service after a failure.
• Packet Loss – The percentage of packets that are lost during transmission. High packet loss can lead to slow performance and connection issues.

To improve network reliability, organizations often use redundancy, such as multiple network links, backup routers, or redundant internet connections. This helps keep services available even if one component fails.

20. A Server Can’t Reach the Internet. Walk me Through your Troubleshooting.

When troubleshooting a server that can’t reach the internet, I follow a step-by-step approach, starting from the network interface and moving upward. This helps me identify the exact point where the problem occurs instead of guessing.

Here’s the order I’d follow:

• Run ip link show to make sure the network interface is UP and the link is active.
• Run ip addr show to verify that the server has a valid IP address. If I see a 169.254.x.x address, it usually means DHCP failed.
• Run ip route show to confirm there’s a default gateway configured. Then I’d ping the gateway to verify local network connectivity.
• Next, I’d run ping 8.8.8.8. If this works, I know basic internet connectivity is working.
• Then I’d test DNS using dig google.com or nslookup google.com. If I can ping 8.8.8.8 but DNS lookups fail, the issue is with DNS rather than network connectivity.
• If packets are being lost or the connection is unstable, I’d use mtr 8.8.8.8 or traceroute to identify where the traffic is failing.
• Finally, if I’m troubleshooting a specific application or service, I’d use ss -tulpn to verify that it’s listening on the expected port and check whether firewall rules are blocking the traffic.

The key is to troubleshoot one layer at a time, starting with the network interface, then IP configuration, routing, internet connectivity, DNS, and finally the application or service. This systematic approach helps isolate the problem quickly and avoids unnecessary guesswork.

Knowing the commands is important, but knowing why you run them and in what order is what interviewers are really looking for. For example, if you can quickly determine whether the problem is network connectivity or DNS resolution, you’re already troubleshooting like a Linux administrator.

Conclusion

Reading interview answers is helpful, but you’ll remember them much better if you practice saying them out loud. In a real interview, employers aren’t just looking for someone who can list commands, they want to hear how you think through a problem. The strongest answers explain both what command you’d run and why you’d run it next.

The more you practice explaining your troubleshooting process in a clear, logical order, the more confident you’ll sound during technical interviews.

Have you been asked a networking interview question that isn’t on this list? Share it in the comments below. If it’s a good one, I’ll include it in the next update to help other Linux learners prepare.