Computer Networks Interview Questions

The TCP 3-way handshake establishes a reliable connection over an unreliable IP network by synchronizing sequence numbers:

1. SYN: The client sends a segment with a random initial sequence number ($ISN_C$) and the SYN bit set to 1. State: SYN-SENT.
2. SYN-ACK: The server responds with its own random initial sequence number ($ISN_S$), sets the SYN bit to 1, and acknowledges the client's packet by setting ACK to 1 and the acknowledgment number to $ISN_C + 1$. State: SYN-RECEIVED.
3. ACK: The client acknowledges the server's segment by setting the ACK bit to 1 and the acknowledgment number to $ISN_S + 1$. State: ESTABLISHED on both sides.

TCP connections are full-duplex, meaning each direction must be terminated independently:

1. FIN (Client to Server): Client sends a segment with the FIN bit set, indicating it has no more data to send. Client state: FIN-WAIT-1.
2. ACK (Server to Client): Server acknowledges the FIN with an ACK. Server state: CLOSE-WAIT; Client state: FIN-WAIT-2. The server can still send data.
3. FIN (Server to Client): Once the server finishes sending data, it sends its own FIN. Server state: LAST-ACK.
4. ACK (Client to Server): Client acknowledges the server's FIN with an ACK and enters the TIME-WAIT state, waiting for $2 \times MSL$ (Maximum Segment Lifetime) before transitioning to CLOSED. Server enters CLOSED immediately upon receiving the ACK.

The TIME-WAIT state (usually lasting 2 to 4 minutes) serves two critical purposes:

• Guarantees final ACK delivery: If the final ACK is lost, the server remains in LAST-ACK and retransmits its FIN. The client must remain active to re-send the ACK.
• Drains delayed packets: It allows older, delayed packets belonging to the connection to expire in the network, preventing them from corrupting subsequent connections using the same socket pairs.

• Flow Control: End-to-end mechanism that prevents a fast sender from overwhelming a slow receiver. It uses a Receiver Window (rwnd) advertised in the TCP header to limit unacknowledged data.
• Congestion Control: Global network mechanism that prevents sender nodes from overwhelming the intermediate routers and links. It uses a calculated Congestion Window (cwnd) in the OS kernel.
• Effective Window limit: The sender cannot transmit more than $\min(rwnd, cwnd)$ bytes of unacknowledged data.

• HTTP/1.1 HoL Blocking: Occurs because browsers can only send requests sequentially over a single TCP connection. If a resource takes long to generate, subsequent requests on that pipe are blocked.
• HTTP/2 Multiplexing: Resolves this by breaking HTTP transactions into binary frames. These frames are interleaved over a single TCP connection within independent concurrent streams.
• Remaining Limitation: HTTP/2 is still susceptible to TCP-level HoL blocking (if one packet is lost, TCP stalls all streams until that packet is retransmitted).

HTTP/2 multiplexes streams over a single TCP connection, but suffers from TCP-level Head-of-Line (HoL) Blocking: if one TCP packet is lost, all streams stall while TCP retransmits and reorders.

• The QUIC Solution: QUIC (Quick UDP Internet Connections) operates over UDP and implements connection-state tracking inside the user-space application layer.
• Independent Streams: Each HTTP/3 stream is treated as an independent logical path. A packet loss on Stream A only blocks Stream A; Stream B and Stream C continue transmitting without delay.
• 0-RTT Handshake: Combines connection and TLS 1.3 handshakes into a single round trip, and supports 0-RTT session resumption.
• Connection Migration: Connections are identified by a 64-bit Connection ID rather than the IP-port 4-tuple, allowing a mobile device to switch from Wi-Fi to cellular data without interrupting active downloads.

• Speed (1-RTT vs 2-RTT):
  • TLS 1.2 requires two full round-trips (2-RTT) to negotiate cipher suites, exchange keys via DH, and verify certificates.
  • TLS 1.3 reduces this to a single round-trip (1-RTT) by guessing the client's key exchange algorithm and sending the key share in the initial Client Hello.
• 0-RTT Resumption: TLS 1.3 allows clients to send encrypted application data on the very first packet when reconnecting to a known server using Pre-Shared Keys (PSK).
• Hardened Security:
  • TLS 1.3 removes obsolete/vulnerable cryptographic primitives (e.g., MD5, SHA-1, RC4, DES, static RSA key exchange).
  • It mandates Perfect Forward Secrecy (PFS) by forcing Ephemeral Diffie-Hellman (ECDHE) for all key exchanges, ensuring that a future private key compromise cannot decrypt past sessions.

• Loss-Based (Cubic, Reno): These assume packet loss is a direct indicator of network congestion. They aggressively ramp up throughput until a packet is dropped, filling up bottleneck buffers (causing Bufferbloat and latency spikes) and then cutting their window size in half.
• TCP BBR (Bottleneck Bandwidth and RTT): BBR is a model-based algorithm developed by Google.
• The Mechanism: Instead of looking for packet drops, BBR actively measures:
  1. RTprop (Round-Trip Propagation Time): The absolute minimum physical RTT of the path.
  2. BtlBw (Bottleneck Bandwidth): The maximum capacity of the path.
• Execution: BBR maintains an internal model and paces packet delivery to match the exact bottleneck bandwidth without overfilling router queues, keeping latency low and throughput high even over lossy wireless links.

• DoT (DNS over TLS):
  • Encapsulates DNS queries inside TLS over a dedicated port (853).
  • Easily monitored, blocked, or rate-limited by network administrators and firewalls because of the dedicated port.
• DoH (DNS over HTTPS):
  • Encapsulates DNS queries inside standard HTTP/2 or HTTP/3 frames over port 443 (sharing the same port as normal web traffic).
  • Highly resistant to censorship and firewalls because it is indistinguishable from standard HTTPS traffic. However, it bypasses local network security controls and enterprise DNS filters.

• Traditional Hashing ($\text{Node} = \text{Hash}(key) \pmod N$):
  • If the number of load balancer backend nodes $N$ changes (due to scale-up or failure), almost all keys map to entirely different nodes, destroying system caches.
• Consistent Hashing:
  • Keys and backend nodes are mapped onto a circular 360-degree mathematical ring (hash ring).
  • A key is routed to the first node encountered moving clockwise from the key's hash position.
  • Impact: When a node is added or removed, only a fraction ($\frac{1}{N}$) of the keys need to be rehashed and migrated.
  • Virtual Nodes: Scales keys evenly by mapping a single physical node to multiple virtual positions on the ring to prevent hot spots.