Computer Networks MCQ

Explanation

IP (Internet Protocol) is the principal communications protocol responsible for delivering packets across network boundaries based on IP addresses.

Explanation

The OSI (Open Systems Interconnection) model has 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, Application. It is a reference model; TCP/IP maps to it roughly.

Explanation

IP operates at the Network layer (Layer 3), responsible for logical addressing and routing packets between networks.

Explanation

MAC (Media Access Control) addresses are 48-bit hardware addresses (e.g., AA:BB:CC:DD:EE:FF) used at the Data Link layer for communication within a local network.

Explanation

DNS translates human-readable domain names (google.com) into IP addresses (142.250.80.46), acting as the internet's phone book.

Explanation

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to devices joining a network.

Explanation

Routers operate at Layer 3 (Network layer) and route packets between different networks (e.g., LAN to internet) based on routing tables and IP addresses.

Explanation

Switches learn MAC addresses and forward frames only to the correct port, unlike hubs that broadcast to all ports. Switches operate at the Data Link layer.

Explanation

TCP (connection-oriented, with handshake, acknowledgments, retransmissions) is used for reliable data like web pages and email. UDP (connectionless, no guarantees) is used for real-time apps like video calls.

Explanation

IPv4 addresses are 32-bit numbers (e.g., 192.168.1.1). IPv6 addresses are 128-bit. IP addresses identify devices and are used by routers to forward packets.

Explanation

IPv4 address exhaustion drove IPv6 adoption. IPv6 has 128-bit addresses, built-in IPSec support, stateless auto-configuration, and eliminates NAT need.

Explanation

NAT allows multiple devices with private IPs (192.168.x.x) to share a single public IP address. The router modifies source addresses in outgoing packets and reverses them for incoming packets.

Explanation

Firewalls filter traffic based on IP addresses, ports, protocols, and state. Packet-filtering, stateful inspection, and next-generation firewalls (NGFW) offer increasing sophistication.

Explanation

VPNs encrypt traffic between a client and VPN server, providing privacy, anonymity, and secure access to remote networks as if directly connected.

Explanation

HTTP uses a request-response model. The client sends HTTP methods (GET, POST, PUT, DELETE) and the server responds with status codes (200 OK, 404 Not Found) and data.

Explanation

HTTPS encrypts HTTP traffic using TLS, preventing eavesdropping and MITM attacks. The TLS handshake authenticates the server via certificates and establishes a shared session key.

Explanation

Subnet mask 255.255.255.0 (/24 in CIDR) means the first 24 bits are the network portion and the last 8 bits identify hosts within that subnet (256 addresses).

Explanation

FTP operates on ports 20 (data) and 21 (control), providing file upload/download. SFTP (over SSH) and FTPS (FTP over TLS) are secure alternatives.

Explanation

The loopback address (127.0.0.1) allows a host to communicate with itself. Used for testing network applications without actual network hardware.

Explanation

HTTP uses port 80 by default. HTTPS uses port 443. Ports identify specific network services on a host.

Explanation

LANs (Local Area Networks) use Ethernet (wired) or Wi-Fi (wireless), typically owned by a single organization, with speeds from 100 Mbps to 100 Gbps.

Explanation

WANs (e.g., the internet, corporate WANs) connect multiple LANs across cities or countries. They use technologies like MPLS, Frame Relay, and SD-WAN.

Explanation

ping sends ICMP Echo Request packets and measures the time for Echo Reply to return (RTT). Used to test connectivity and measure latency.

Explanation

ARP (Address Resolution Protocol) broadcasts "Who has IP x.x.x.x?" and receives the corresponding MAC address for Data Link layer communication within a subnet.

Explanation

For subnet 192.168.1.0/24, the broadcast address is 192.168.1.255. Packets sent to this address are delivered to all devices on the subnet.

Explanation

SSH (port 22) replaces insecure Telnet/rlogin, providing encrypted shell access, port forwarding, and secure file transfer (SFTP/SCP) using public-key or password authentication.

Explanation

SMTP sends email from clients to servers and between servers. IMAP (port 993) and POP3 (port 995) are used to retrieve email from servers.

Explanation

ICMP (Layer 3) carries messages like "host unreachable," "time exceeded" (used by traceroute), and Echo Request/Reply (ping). Not for data transfer.

Explanation

Bandwidth is the capacity of a network link (e.g., 1 Gbps Ethernet). Throughput is actual achieved data rate, always ≤ bandwidth. Latency is delay — different from bandwidth.

Explanation

Proxy servers sit between clients and servers. Forward proxies serve clients (caching, filtering). Reverse proxies serve servers (load balancing, SSL termination). Transparent proxies don't modify requests.

Explanation

Ports (0-65535) identify application-layer services. Well-known ports (0-1023): HTTP=80, HTTPS=443, SSH=22, FTP=21. Source ports (ephemeral) identify connections from clients.

Explanation

Traceroute sends packets with TTL=1,2,3... Each router decrements TTL; on TTL=0, it sends "Time Exceeded" ICMP back. This maps each hop's IP address and latency.

Explanation

TCP's 3-way handshake: client sends SYN, server responds SYN-ACK, client sends ACK. This establishes connection state. UDP sends data immediately without setup.

Explanation

Ethernet is the dominant wired LAN technology. It uses frames with MAC addresses. Modern Ethernet (1000BASE-T, 10GBASE-T) uses star topology with switches rather than shared bus.

Explanation

Wi-Fi standards: 802.11n (Wi-Fi 4), 802.11ac (Wi-Fi 5, 5GHz, up to 3.5 Gbps), 802.11ax (Wi-Fi 6, 2.4/5/6GHz). Uses access points for infrastructure mode.

Explanation

TLS (Transport Layer Security, the successor to SSL) establishes encrypted channels using asymmetric cryptography for key exchange and symmetric encryption for data. Used by HTTPS, SMTP, and more.

Explanation

Hubs create a collision domain — all ports share bandwidth. Switches learn MAC addresses and create separate collision domains per port, dramatically improving performance.

Explanation

In Ethernet (CSMA/CD), devices in the same collision domain contend for the shared medium. Switches separate collision domains per port. Hubs extend collision domains.

Explanation

BGP (the "protocol of the internet") manages how packets are routed between different networks (autonomous systems, ASes). ISPs and large organizations use BGP to exchange routing information.

Explanation

When a device wants to communicate with an IP outside its subnet, it sends the packet to the default gateway (usually the router). The router then forwards it toward the destination.

Explanation

OSPF routers exchange link-state advertisements (LSAs) to build an identical topology database, then each independently runs Dijkstra's algorithm to compute shortest paths, supporting areas and VLSM for scalability.

Explanation

SYN: client proposes initial seq num. SYN-ACK: server acknowledges and proposes its own seq num. ACK: client acknowledges server. This establishes seq nums needed for reliable, ordered delivery.

Explanation

TCP slow start exponentially increases the congestion window (cwnd) each round until either a packet loss occurs (drops cwnd to 1 or half) or ssthresh is reached (switches to congestion avoidance).

Explanation

Stateful inspection tracks TCP/UDP connections in a state table. Return packets matching established connections are automatically allowed. Stateless firewalls apply rules to each packet independently (faster but less context-aware).

Explanation

VLANs segment a physical switch into multiple logical networks using 802.1Q VLAN tags. Devices in different VLANs cannot communicate without a router (Layer 3 switch) handling inter-VLAN routing.

Explanation

Distance vector (RIP): slow convergence, count-to-infinity problem. Link-state (OSPF, IS-IS): routers flood topology info, build a complete map, faster convergence, more scalable.

Explanation

QoS uses traffic classification, queuing disciplines (WFQ, DSCP/DiffServ marking), shaping, and policing to prioritize voice/video over bulk traffic to meet SLA requirements.

Explanation

CUBIC (Linux default) maintains a cubic window growth function based on elapsed time since last loss, independently of RTT. It better utilizes high-bandwidth, high-latency links than Reno's RTT-dependent additive increase.

Explanation

CDNs (Cloudflare, Akamai, CloudFront) distribute content to edge nodes worldwide. DNS returns the IP of the nearest edge server, reducing latency from 200ms+ to <20ms for cached content.

Explanation

TCP teardown uses a 4-way handshake: FIN→ACK→FIN→ACK. Each side independently closes its sending direction, allowing half-duplex close when one side is done sending but still receiving.

Explanation

MPLS adds a label between Layer 2/3 headers. Label-switching routers forward based on labels (faster than IP lookup). Used by ISPs for traffic engineering, VPNs, and QoS.

Explanation

NAT breaks the internet's end-to-end model. Protocols like FTP (PORT command embeds IP) and SIP/VoIP need ALGs. P2P requires NAT traversal (STUN/TURN/ICE) for hole punching.

Explanation

CAP (Brewer): during a network partition, a distributed system must choose between Consistency (all nodes see same data) or Availability (every request gets a response). Partition tolerance is required in real networks.

Explanation

QUIC (now standardized as RFC 9000, used by HTTP/3) runs over UDP, eliminating TCP head-of-line blocking. It integrates TLS 1.3 for 0-RTT/1-RTT setup and supports connection migration.

Explanation

SDN decouples the control plane (routing decisions) from the data plane (packet forwarding). Controllers (OpenDaylight, ONOS) program switches via OpenFlow, enabling dynamic traffic engineering.

Explanation

Routing protocols (OSPF, BGP) compute paths and populate routing tables (control plane). Forwarding uses the table to switch packets in hardware (data plane, ASICs, nanoseconds per packet).

Explanation

HTTP/1.1 opens multiple TCP connections for parallelism. HTTP/2 multiplexes many streams over one connection, uses HPACK for header compression, and allows server push for proactive resource delivery.

Explanation

Core (high-speed backbone), Distribution (routing, filtering, aggregation), Access (connects end devices). This hierarchical design scales from small LANs to large enterprise networks.

Explanation

BGP route hijacking (e.g., Pakistan Telecom 2008 YouTube outage) occurs when a router advertises more specific prefixes. RPKI (Resource Public Key Infrastructure) helps prevent this by cryptographically validating route origins.

Explanation

The receiver advertises rwnd (receive window) in ACKs. The sender limits in-flight bytes to min(cwnd, rwnd). Flow control prevents overwhelming the receiver; congestion control prevents overwhelming the network.

Explanation

Anycast assigns the same IP to servers worldwide. BGP routing naturally sends packets to the topologically nearest server. Used by DNS root servers (13 "addresses," hundreds of servers worldwide) and CDNs.

Explanation

EIGRP uses a composite metric (bandwidth, delay, reliability) and DUAL algorithm — fast convergence. OSPF is an open standard supporting VLSM, areas for scalability, and multi-vendor interoperability.

Explanation

STP (IEEE 802.1D) elects a root bridge and blocks redundant paths, preventing broadcast storms. RSTP (802.1w) converges faster (~1-2 seconds vs 30-50 for STP).

Explanation

DNS TTL is set by zone administrators (e.g., 3600 seconds). Resolvers cache answers until TTL expires, reducing load on authoritative servers. Short TTLs enable faster propagation of changes but increase query load.

Explanation

5G network slicing uses SDN/NFV to create isolated virtual networks: one slice for low-latency IoT (1ms), another for mobile broadband (high throughput), another for critical infrastructure (ultra-reliable).

Explanation

PSTN uses circuit switching (dedicated bandwidth, predictable delay). The internet uses packet switching (better resource utilization, bursty traffic, variable delay). Circuit switching is wasteful for idle periods.

Explanation

A socket is identified by (IP, port, protocol). A connection is identified by the 5-tuple: (src IP, src port, dst IP, dst port, protocol). Applications use socket APIs (BSD sockets) to communicate over networks.

Explanation

DNSSEC signs DNS records with private keys. Resolvers verify signatures using the public key chain from the root. It prevents Kaminsky-style DNS cache poisoning attacks by ensuring response authenticity.

Explanation

Load balancers (L4: transport layer, L7: application layer) distribute requests. Round-robin (simple), least connections (considers active load), IP hash (session persistence), weighted (server capacity differences).

Explanation

A /26 subnet has 6 host bits, giving 2^6 = 64 total addresses. Subtracting the network address and broadcast address leaves 62 usable host addresses — the standard formula is 2^(host bits) − 2.

Explanation

When a route disappears, distance-vector routers may keep advertising stale routes to each other, incrementing the metric each time. Split horizon (don't advertise a route back to where it came from) and route poisoning (advertise a failed route with infinite metric) prevent these loops.

Explanation

Each router decrements the TTL field by one; when it reaches zero, the packet is discarded and an ICMP Time Exceeded message is returned. This prevents undeliverable packets from circulating indefinitely due to routing loops.

Explanation

A sender transmits with the Don't Fragment flag; if a router's outgoing link MTU is smaller, it drops the packet and returns an ICMP message reporting its MTU. The sender reduces packet size accordingly, avoiding fragmentation overhead and potential black holes.

Explanation

Clients typically send recursive queries to a resolver, which then performs iterative queries — starting at root servers, then TLD servers, then authoritative servers — following referrals until it gets the final answer to return to the client.

Explanation

Layer 3 switches perform IP routing using application-specific integrated circuits (ASICs) at near wire-speed, making them ideal for routing between VLANs within a data center or campus, where traditional software-based routers would be a bottleneck.

Explanation

By broadcasting forged ARP replies, an attacker can convince other hosts that the attacker's MAC address corresponds to the default gateway's IP, enabling man-in-the-middle interception of traffic — a classic local-network attack mitigated by dynamic ARP inspection and static ARP entries.

Explanation

TCP keepalive sends probe segments after a period of inactivity (commonly defaulting to around two hours) and expects an ACK in response; if no response arrives after several retries, the connection is considered dead and is closed, freeing resources.

Explanation

In the hidden node problem, two stations can both reach the access point but not each other, causing collisions at the AP. RTS/CTS lets a station reserve the medium via the AP before transmitting, so the other hidden station defers, avoiding collisions.

Explanation

Forward proxies are deployed near clients to control or anonymize their outbound requests (common in corporate networks). Reverse proxies (e.g. Nginx, HAProxy) sit in front of backend servers to distribute load, cache content, and terminate TLS, presenting a single interface to clients.

Explanation

A host uses its subnet mask to decide whether a destination is on its local network or must be sent via the default gateway. If the mask is wrong, the host may try to ARP for an off-subnet address directly; if the gateway is missing or incorrect, the host has no route to forward traffic destined for remote networks like the internet.

Explanation

3 duplicate ACKs = receiver got something out of order. Fast retransmit sends the missing segment immediately. Combined with Fast Recovery (halve cwnd instead of resetting to 1) for efficiency.

Explanation

BBR (2016) probes for bottleneck bandwidth and RTT, operating at Kleinrock's optimal point. It achieves 2700x higher throughput than CUBIC on lossy links and lower latency by avoiding buffer bloat.

Explanation

ECMP installs multiple equal-cost routes. Per-flow hashing (src/dst IP+port) ensures packet ordering. Used in data center leaf-spine fabrics for full-mesh bandwidth between servers.

Explanation

BGP communities (RFC 1997) tag routes with policy metadata. Upstream ISPs honor communities to set local preference, no-export, or blackhole routes. Large communities (RFC 8092) extend the 32-bit space.

Explanation

PCE (RFC 5440, PCEP protocol) computes optimal TE paths considering bandwidth constraints, affinities, and SLAs. In SR-PCE (Segment Routing), the controller installs explicit segment lists on ingress routers.

Explanation

DPDK maps NIC registers to user space. AF_XDP allows kernel bypass for selected packets. io_uring uses shared ring buffers reducing syscall overhead. Together, enable millions of packets/sec from a single CPU core.

Explanation

SR-MPLS: segments are MPLS labels. SRv6: segments are IPv6 addresses in a Routing Extension Header. Eliminates LDP/RSVP-TE for path setup. Transit nodes just pop/swap labels with no per-flow state.

Explanation

P4 allows network engineers to define custom packet parsing, match-action processing, and forwarding pipelines. It enables rapid deployment of new protocols without waiting for ASIC redesigns.

Explanation

RPKI issues Route Origin Authorizations (ROAs) signed by IP address holders. Routers validate BGP announcements against ROAs. Invalid routes (wrong ASN or more specific prefix) can be filtered.

Explanation

Wi-Fi 6E operates in 6 GHz (5.925-7.125 GHz in the US). Only Wi-Fi 6E-capable devices access it, eliminating legacy overhead. 14× 80MHz or 7× 160MHz channels enable multi-gigabit speeds with minimal interference.

Explanation

Without SACK, TCP uses go-back-N (retransmit from loss point). With SACK (RFC 2018), the receiver reports gaps in received data. The sender retransmits only the missing segments, dramatically improving throughput on lossy links.

Explanation

VXLAN (RFC 7348) encapsulates Ethernet frames in UDP (port 4789) with a 24-bit VNI (16M virtual networks vs VLAN's 4096). Used by VMware NSX, Open vSwitch, and cloud providers for tenant isolation.

Explanation

OLSR, DSDV: proactive — always ready but consumes bandwidth maintaining routes. AODV, DSR: reactive — lower overhead but route discovery delay. Hybrid protocols (ZRP) combine both.

Explanation

Settlement-free peering at IXPs (Internet Exchange Points) allows ISPs to exchange traffic without money changing hands. Transit customers pay upstream providers for global reach. Peering policies shape the internet's commercial structure.

Explanation

Nagle combines small writes into full MSS segments to reduce overhead. But for interactive protocols (SSH keystrokes, gaming, trading) it adds up to 200ms latency. TCP_NODELAY socket option disables it.

Explanation

HTTP/3 (RFC 9114) runs over QUIC (RFC 9000). Unlike HTTP/2 over TCP (where one lost packet stalls all streams), QUIC provides independent per-stream loss recovery. 0-RTT handshake reduces connection setup overhead.

Explanation

NFV (ETSI NFV framework) replaces proprietary hardware (Cisco ASA, F5 load balancers) with Virtualized Network Functions (VNFs) on commodity x86 servers, reducing cost and enabling rapid deployment.

Explanation

NTP (RFC 5905) achieves millisecond accuracy using hierarchical stratum levels. Distributed systems (Spanner, Kafka) require synchronized clocks for ordering. TLS certificates fail if system time is wrong. PTP achieves nanosecond accuracy.

Explanation

Bufferbloat occurs when oversized buffers let queues grow, adding latency without triggering congestion signals. CoDel measures each packet's time spent in the queue and drops packets once that delay persists beyond a target threshold, keeping queues shallow while still allowing bursts, prompting TCP senders to reduce their rate.

Explanation

Leaf-spine fabrics rely on ECMP to use all available spine uplinks for load distribution. Hashing on the flow's 5-tuple ensures that every packet belonging to the same flow is consistently routed over the same path, so packets arrive in order and TCP does not misinterpret reordering as loss, which would otherwise trigger unnecessary retransmissions and throughput collapse.