Layering, addressing, routing and switching

Why it matters

A reliable way into networking questions in systems interviews is to ask: which box makes which decision, using which header field, looked up in which table? If you can trace a packet through a laptop, a home router, a cloud VPC and a load balancer while naming the lookup at each hop, you can reason about reachability bugs, MTU problems, NAT surprises and why a subnet ran out of addresses. Cloud networking (VPC subnets, route tables, overlay networks in Kubernetes) is the same model with software doing the forwarding.

Core ideas

Layering and encapsulation. Each layer adds a header that only its peer layer interprets: application data, then a transport segment (ports), then an IP packet (addresses), then a link-layer frame (MAC addresses). The link layer moves frames within one network, IP moves packets between networks, and transport multiplexes between processes on the end hosts. Routers rewrite the link-layer header at every hop but leave the IP addresses alone unless NAT is involved.

Addresses and prefixes. An IPv4 address has 32 bits; a prefix such as 10.20.0.0/16 names every address that shares its first 16 bits. CIDR replaced fixed address classes, so prefixes can have any length and can be aggregated: 10.20.0.0/17 and 10.20.128.0/17 together form one /16. A /24 holds 256 addresses, but the network and broadcast addresses are reserved, and cloud providers reserve a few more per subnet. IPv6 uses 128-bit addresses written in hex with :: compression, normally /64 subnets with stateless autoconfiguration, and replaces ARP with Neighbor Discovery over ICMPv6. Private ranges plus NAT let many hosts share one public address, at the cost of end-to-end addressing: inbound connections need explicit port mappings and the NAT holds per-connection state.

Forwarding versus routing. Forwarding is the per-packet data-plane step: look up the destination and choose the entry with the longest matching prefix. With routes 10.0.0.0/8 via A and 10.1.0.0/16 via B, a packet to 10.1.2.3 goes to B, one to 10.2.0.1 goes to A, and 0.0.0.0/0 (the default route) catches everything else. Routing is the control-plane process (static configuration, OSPF, BGP) that fills the table. Because forwarding only consults the table, a more-specific route installed by any source silently overrides a broader one.

Within one network: ARP and switching. A host sends directly to destinations in its own subnet and to its default gateway otherwise. To build the Ethernet frame it needs the next hop's MAC address, which ARP obtains by broadcasting a request and caching the reply. Switches learn which MAC address sits behind which port from source addresses, forward known destinations to one port and flood unknown ones; spanning tree or a routed fabric prevents loops, and VLANs split one physical switch into separate broadcast domains.

Supporting pieces. TTL (hop limit in IPv6) stops looping packets and makes traceroute possible. ICMP carries errors such as "destination unreachable" and "fragmentation needed"; filtering it can break path-MTU discovery, producing connections that handshake but hang on large transfers. DHCP hands a host its address, prefix length, gateway and DNS servers.

Common misconceptions

• "Routers keep a table of hosts." They match prefixes, and the most specific matching prefix wins regardless of the order in which routes were added.
• "The MAC address travels end to end." It is replaced at every IP hop; only the IP header survives across networks, apart from TTL and checksum updates and any NAT rewrites.
• "A /24 gives 256 usable hosts." Two addresses are reserved by convention and cloud subnets reserve more, which matters when sizing subnets for autoscaling groups or pods.
• "IPv6 is IPv4 with longer addresses." Autoconfiguration, Neighbor Discovery, no fragmentation by routers and the usual absence of NAT change day-to-day operations.
• "Switches and routers do the same job." A switch forwards frames by MAC address inside a broadcast domain; a router forwards packets by IP prefix between networks. Many devices do both, with different tables.

How to approach it

Drill the arithmetic until it is automatic: prefix length to block size, whether two addresses share a subnet, how to split a /16 into /20s. Then trace scenarios end to end, such as a laptop fetching a page through a home NAT, or a pod reaching a pod on another node. Graduate-level questions check encapsulation, longest-prefix match and ARP; mid and senior levels add VPC address planning (non-overlapping ranges for peering, room for growth), NAT and MTU failure modes, and how you would debug "cannot reach host X" layer by layer.