Computer Networks Interview Questions — Hard

HTTP/2 multiplexes streams over a single TCP connection, but suffers from TCP-level Head-of-Line (HoL) Blocking: if one TCP packet is lost, all streams stall while TCP retransmits and reorders.

• The QUIC Solution: QUIC (Quick UDP Internet Connections) operates over UDP and implements connection-state tracking inside the user-space application layer.
• Independent Streams: Each HTTP/3 stream is treated as an independent logical path. A packet loss on Stream A only blocks Stream A; Stream B and Stream C continue transmitting without delay.
• 0-RTT Handshake: Combines connection and TLS 1.3 handshakes into a single round trip, and supports 0-RTT session resumption.
• Connection Migration: Connections are identified by a 64-bit Connection ID rather than the IP-port 4-tuple, allowing a mobile device to switch from Wi-Fi to cellular data without interrupting active downloads.

• Speed (1-RTT vs 2-RTT):
  • TLS 1.2 requires two full round-trips (2-RTT) to negotiate cipher suites, exchange keys via DH, and verify certificates.
  • TLS 1.3 reduces this to a single round-trip (1-RTT) by guessing the client's key exchange algorithm and sending the key share in the initial Client Hello.
• 0-RTT Resumption: TLS 1.3 allows clients to send encrypted application data on the very first packet when reconnecting to a known server using Pre-Shared Keys (PSK).
• Hardened Security:
  • TLS 1.3 removes obsolete/vulnerable cryptographic primitives (e.g., MD5, SHA-1, RC4, DES, static RSA key exchange).
  • It mandates Perfect Forward Secrecy (PFS) by forcing Ephemeral Diffie-Hellman (ECDHE) for all key exchanges, ensuring that a future private key compromise cannot decrypt past sessions.

• Loss-Based (Cubic, Reno): These assume packet loss is a direct indicator of network congestion. They aggressively ramp up throughput until a packet is dropped, filling up bottleneck buffers (causing Bufferbloat and latency spikes) and then cutting their window size in half.
• TCP BBR (Bottleneck Bandwidth and RTT): BBR is a model-based algorithm developed by Google.
• The Mechanism: Instead of looking for packet drops, BBR actively measures:
  1. RTprop (Round-Trip Propagation Time): The absolute minimum physical RTT of the path.
  2. BtlBw (Bottleneck Bandwidth): The maximum capacity of the path.
• Execution: BBR maintains an internal model and paces packet delivery to match the exact bottleneck bandwidth without overfilling router queues, keeping latency low and throughput high even over lossy wireless links.

• DoT (DNS over TLS):
  • Encapsulates DNS queries inside TLS over a dedicated port (853).
  • Easily monitored, blocked, or rate-limited by network administrators and firewalls because of the dedicated port.
• DoH (DNS over HTTPS):
  • Encapsulates DNS queries inside standard HTTP/2 or HTTP/3 frames over port 443 (sharing the same port as normal web traffic).
  • Highly resistant to censorship and firewalls because it is indistinguishable from standard HTTPS traffic. However, it bypasses local network security controls and enterprise DNS filters.

• Traditional Hashing ($\text{Node} = \text{Hash}(key) \pmod N$):
  • If the number of load balancer backend nodes $N$ changes (due to scale-up or failure), almost all keys map to entirely different nodes, destroying system caches.
• Consistent Hashing:
  • Keys and backend nodes are mapped onto a circular 360-degree mathematical ring (hash ring).
  • A key is routed to the first node encountered moving clockwise from the key's hash position.
  • Impact: When a node is added or removed, only a fraction ($\frac{1}{N}$) of the keys need to be rehashed and migrated.
  • Virtual Nodes: Scales keys evenly by mapping a single physical node to multiple virtual positions on the ring to prevent hot spots.