Networking Fundamentals Interview Questions and Answers – Part 3: Ethernet, Frames, MTU & Troubleshooting

In Part 1, we established the basic networking concepts and devices. In Part 2, we examined how traffic moves between hosts, including ARP, default gateways, switches, routers, encapsulation and packet flow.

This part focuses on the technology that actually carries Ethernet traffic across a LAN.

You will learn:

• Ethernet fundamentals
• Copper and fiber media
• Ethernet standards
• Ethernet frames
• MAC addressing
• MTU
• Speed and duplex
• Auto-negotiation
• CRC errors
• Late collisions
• Interface errors
• Broadcast and unknown-unicast behavior
• Layer 1 and Layer 2 troubleshooting

These concepts are important because many real-world network problems begin with something as simple as a bad cable, incorrect speed/duplex configuration, damaged fiber, an incompatible transceiver, or an interface error.

Ethernet Interview Questions and Answers

1. What is Ethernet?

Ethernet is a family of technologies used for wired local-area networking.

Modern Ethernet primarily uses:

• Ethernet frames
• MAC addresses
• Ethernet switches
• Copper or fiber physical media

Ethernet operates primarily at the Physical and Data Link layers of the OSI model.

2. What standards define Ethernet?

Ethernet standards are primarily defined by the IEEE 802.3 family.

Examples include technologies for:

• 10 Mbps Ethernet
• 100 Mbps Fast Ethernet
• 1 Gbps Ethernet
• 10 Gbps Ethernet
• 25 Gbps Ethernet
• 40 Gbps Ethernet
• 100 Gbps Ethernet
• Higher-speed data-center Ethernet

The exact physical implementation depends on the Ethernet standard and media being used.

3. What is Fast Ethernet?

Fast Ethernet generally refers to 100 Mbps Ethernet.

A commonly encountered implementation is:

100BASE-TX

It uses twisted-pair copper cabling.

4. What is Gigabit Ethernet?

Gigabit Ethernet provides a nominal data rate of 1 Gbps.

Common implementations include:

1000BASE-T

for copper twisted-pair Ethernet.

Gigabit Ethernet is widely used for:

• Server connections
• Switch uplinks
• Desktop connectivity
• Network infrastructure

5. What is 10-Gigabit Ethernet?

10-Gigabit Ethernet provides a nominal data rate of 10 Gbps.

Examples include:

10GBASE-SR
10GBASE-LR
10GBASE-T

The appropriate standard depends on the physical medium, distance and equipment.

Copper Cabling

6. What is twisted-pair Ethernet?

Twisted-pair Ethernet uses pairs of copper wires twisted together to reduce electromagnetic interference and crosstalk.

Common Ethernet copper cabling categories include:

• Cat5e
• Cat6
• Cat6A

The supported speed and distance depend on the cable category, installation quality and Ethernet standard.

7. What is the difference between Cat5e, Cat6 and Cat6A?

They are different categories of twisted-pair cabling with different electrical performance characteristics.

In general:

The exact supported speed depends on the Ethernet standard, channel length and installation conditions.

8. What is crosstalk?

Crosstalk occurs when a signal from one cable pair interferes with another pair.

Excessive crosstalk can cause:

• Packet errors
• Retransmissions
• Reduced performance
• Link instability

Proper cable design and installation reduce crosstalk.

9. What is electromagnetic interference?

Electromagnetic interference (EMI) is unwanted electromagnetic energy that can affect signal transmission.

Potential sources include:

• Motors
• Electrical equipment
• Power cables
• Industrial machinery
• Radio-frequency sources

Fiber optic cable is largely immune to electromagnetic interference because it transmits information using light rather than electrical signals.

10. What is the difference between copper and fiber Ethernet?

The appropriate medium depends on distance, speed, environment and design requirements.

Fiber Optic Networking

11. What is fiber optic networking?

Fiber optic networking transmits data using pulses of light through optical fiber.

It is widely used for:

• Data-center networking
• Switch uplinks
• Long-distance links
• High-speed networking
• Inter-building connectivity

12. What is the difference between single-mode and multimode fiber?

Single-mode fiber

Designed for long-distance optical transmission using a small core and typically a laser-based optical source.

Commonly used for:

• Long-distance links
• Campus connectivity
• Service-provider networks
• Data-center interconnects

Multimode fiber

Uses a larger core and supports multiple propagation modes.

Commonly used for:

• Shorter data-center links
• Building/campus environments
• Short-distance high-speed connections

13. What is the difference between SR and LR optics?

These are common Ethernet optical designations.

SR

Generally refers to Short Reach optics, commonly used with multimode fiber for relatively short distances.

LR

Generally refers to Long Reach optics, commonly used with single-mode fiber for longer distances.

The exact reach depends on the Ethernet standard and optical module.

14. What is an SFP?

SFP stands for Small Form-factor Pluggable.

It is a removable transceiver module used in networking equipment.

An SFP can provide an interface for:

• Copper
• Multimode fiber
• Single-mode fiber

depending on the specific module.

15. What is SFP+?

SFP+ is an enhanced small-form-factor pluggable interface commonly associated with 10 Gigabit Ethernet.

For example:

Switch
  |
SFP+ port
  |
10 GbE optical transceiver
  |
Fiber

16. What is QSFP?

QSFP stands for Quad Small Form-factor Pluggable.

The QSFP family is commonly used for higher-speed networking.

Examples include:

• 40 GbE
• 100 GbE
• Higher-speed implementations depending on the QSFP generation and standard

The exact capabilities depend on the module and equipment.

17. What should you check if a fiber link does not come up?

Check:

1. Correct optic type
2. Supported optic
3. Correct fiber type
4. Fiber polarity
5. Fiber cleanliness
6. Fiber damage
7. Connector condition
8. TX/RX orientation
9. Module seating
10. Interface configuration
11. Transceiver compatibility
12. Optical power levels where supported

Never assume that “the fiber is connected” means the physical link is healthy.

Ethernet Frames

18. What is an Ethernet frame?

An Ethernet frame is the Layer 2 data unit used by Ethernet.

A simplified Ethernet frame contains:

+-------------------+
| Destination MAC   |
+-------------------+
| Source MAC        |
+-------------------+
| EtherType/Length  |
+-------------------+
| Payload           |
+-------------------+
| FCS               |
+-------------------+

The exact frame structure also includes the preamble and Start Frame Delimiter at the physical transmission level.

19. What is the destination MAC address in an Ethernet frame?

It identifies the Layer 2 destination for the frame on the local Ethernet network.

Examples:

00:11:22:33:44:55

For an Ethernet broadcast:

FF:FF:FF:FF:FF:FF

20. What is the source MAC address?

It identifies the source Ethernet interface that transmitted the frame.

For example:

Source MAC:
00:AA:BB:CC:DD:EE

A switch can learn this source MAC and associate it with the ingress interface.

21. What is EtherType?

EtherType identifies the protocol carried in the Ethernet payload.

Common examples include:

0x0800 → IPv4
0x0806 → ARP
0x86DD → IPv6

This allows the receiving device to determine how to process the payload.

22. What is FCS?

FCS stands for Frame Check Sequence.

It is used for error detection in Ethernet frames.

If the received frame fails the integrity check, the frame can be discarded.

CRC-based checking is commonly associated with Ethernet FCS.

23. What is a CRC error?

A CRC error indicates that the received frame failed an integrity check.

Possible causes include:

• Damaged cable
• Faulty optic
• Dirty fiber connector
• Bad transceiver
• Physical interference
• Hardware problems
• Signal-quality issues

CRC errors are generally a strong indication that you should investigate the physical path first.

Ethernet Frame Size and MTU

24. What is MTU?

MTU stands for Maximum Transmission Unit.

It defines the largest IP packet payload that can normally be carried over a particular Layer 3 interface without fragmentation at that interface, subject to the specific protocol and configuration.

For standard Ethernet, the commonly used IPv4/IPv6 MTU is:

1500 bytes

This is an IP-layer concept, so do not confuse the 1500-byte IP MTU with the total Ethernet frame size.

25. Is a 1500-byte MTU the same as a 1500-byte Ethernet frame?

No.

A standard Ethernet frame carries an IP packet that can commonly be up to 1500 bytes with a 1500-byte IP MTU.

The Ethernet frame itself contains additional Layer 2 overhead.

Therefore:

IP packet payload carried by Ethernet
        ≠
Total Ethernet frame size

This distinction is important in interviews.

26. What is a jumbo frame?

A jumbo frame is an Ethernet frame larger than the traditional Ethernet maximum frame size.

Jumbo frames are commonly associated with environments such as:

• Data centers
• Storage networks
• High-performance computing

A commonly used jumbo MTU is:

9000 bytes

However, jumbo frames must be supported consistently across the relevant path.

27. What happens if MTU settings are inconsistent?

An MTU mismatch can cause:

• Packet drops
• Fragmentation in applicable IPv4 scenarios
• Path MTU Discovery problems
• Application failures
• Large packets failing while small packets work

This can produce confusing symptoms.

For example:

Small packets → work
Large packets → fail

An MTU problem should be considered.

28. What is Path MTU Discovery?

Path MTU Discovery (PMTUD) is a mechanism used to determine the largest packet size that can traverse a network path without requiring fragmentation.

It helps hosts select an appropriate packet size based on the smallest MTU along the path.

Problems with filtering of the relevant ICMP messages can cause PMTUD-related connectivity issues.

Speed and Duplex

29. What is link speed?

Link speed is the nominal transmission rate negotiated or configured for an interface.

Examples:

100 Mbps
1 Gbps
10 Gbps

A 1 Gbps link does not mean that an application will necessarily achieve 1 Gbps of useful throughput.

30. What is duplex?

Duplex describes how devices communicate over a link.

Half-duplex

A device can transmit or receive, but not both simultaneously.

Full-duplex

A device can transmit and receive simultaneously.

Modern switched Ethernet networks normally operate in full-duplex mode.

31. What is a duplex mismatch?

A duplex mismatch occurs when two connected Ethernet interfaces operate with incompatible duplex settings.

For example:

Switch → Full Duplex
Server → Half Duplex

Possible symptoms include:

• Poor performance
• Packet errors
• Collisions on the half-duplex side
• Retransmissions
• Late collisions
• Interface errors

Duplex mismatches were more common with older Ethernet deployments and legacy manual configurations.

32. What is auto-negotiation?

Auto-negotiation allows connected Ethernet interfaces to exchange information about supported link capabilities and negotiate compatible parameters.

Depending on the Ethernet technology, this can include:

• Speed
• Duplex
• Other capabilities

For modern Ethernet deployments, consistent auto-negotiation configuration is generally preferred unless a specific design requires otherwise.

33. Why should you be careful when manually configuring speed and duplex?

Because manually forcing one side while leaving the other side to negotiate can create mismatched behavior.

For example:

Switch:
1000 Mbps / Full

Server:
Auto

The actual behavior depends on the Ethernet technology and device implementation.

For troubleshooting, always check both sides of the link rather than assuming the configured values are compatible.

Ethernet Errors

34. What are interface errors?

Interface errors are counters that indicate abnormal conditions detected by a network interface.

Depending on the platform, counters can include:

• Input errors
• Output errors
• CRC errors
• Frame errors
• Giants
• Runts
• Drops
• Overruns
• Collisions
• Late collisions

The exact counter names vary between vendors.

35. What is a runt frame?

A runt is an Ethernet frame that is smaller than the minimum valid Ethernet frame size.

Possible causes can include:

• Collision-related problems
• Faulty network hardware
• Physical problems

In modern full-duplex switched Ethernet, persistent runts should be investigated rather than considered normal.

36. What is a giant frame?

A giant is a frame larger than the supported maximum frame size for the interface or configured Ethernet environment.

Possible causes include:

• MTU mismatch
• Jumbo-frame configuration
• Incorrect interface settings
• Encapsulation overhead
• Faulty equipment

Always interpret giant counters according to the platform’s definition.

37. What are collisions?

A collision occurs when two devices transmit simultaneously over a shared half-duplex Ethernet medium.

Modern full-duplex switched Ethernet eliminates normal Ethernet collisions because transmission and reception occur simultaneously over separate logical paths.

Therefore, persistent collisions on a modern full-duplex interface deserve investigation.

38. What is a late collision?

A late collision is a collision detected after the normal collision-detection window.

Possible causes historically include:

• Duplex mismatch
• Cabling problems
• Excessive cable length
• Physical problems

On modern switched full-duplex Ethernet, late collisions are not expected under normal operation.

39. What is input error?

An input error is a receive-side error counter.

The exact meaning varies by vendor and platform.

It can include conditions such as:

• CRC errors
• Frame errors
• Overruns
• Other receive errors

Always inspect the individual counters rather than treating “input errors” as a single diagnosis.

40. What is an output error?

An output error is a transmit-side interface error.

Possible causes can include:

• Hardware problems
• Queue/buffer issues
• Physical problems
• Oversubscription
• Interface faults

Again, the exact meaning depends on the network platform.

Layer 1 Troubleshooting

41. What is the correct troubleshooting approach when an Ethernet link is down?

Start with Layer 1.

Check:

Physical connection

• Cable connected?
• Correct port?
• Correct patch panel?
• Link LED?

Interface state

• Administratively enabled?
• Operationally up?

Cable

• Correct cable?
• Damaged?
• Tested?

Optics

• Correct type?
• Supported?
• Properly seated?

Fiber

• Correct polarity?
• Clean?
• Correct single-mode/multimode type?

Device compatibility

• Speed supported?
• Transceiver supported?
• Interface configuration compatible?

Only after Layer 1 is confirmed should you move deeper into Layer 2 and Layer 3.

42. What is the difference between administratively down and operationally down?

Administratively down

The interface has been intentionally disabled through configuration.

Operationally down

The interface is enabled but does not have a working physical link.

For example:

Administratively Down

usually indicates that the interface has been shut down.

An interface that is:

Admin Up
Link Down

requires investigation of the physical connection or the remote endpoint.

Layer 2 Troubleshooting

43. What should you check if the physical link is up but communication fails?

Move to Layer 2.

Check:

• VLAN assignment
• Access/trunk configuration
• MAC address learning
• STP state
• Port security
• Error counters
• Duplex/speed
• Interface drops
• Broadcast behavior
• MAC flapping

Later CCNA sections will cover VLANs, trunks and STP in detail.

44. What is MAC flapping?

MAC flapping occurs when a switch repeatedly learns the same MAC address on different ports.

Example:

MAC-A → Port 1
MAC-A → Port 2
MAC-A → Port 1
MAC-A → Port 2

Possible causes include:

• Layer 2 loop
• Incorrect topology
• Redundant path problem
• Virtualization behavior
• Misconfiguration

MAC flapping is an important Layer 2 troubleshooting symptom.

45. Why can a Layer 2 loop be dangerous?

A Layer 2 loop can cause:

• Broadcast storms
• Unknown-unicast flooding
• MAC table instability
• Excessive CPU utilization
• Network congestion
• Network-wide outages

Spanning Tree Protocol exists largely to prevent Layer 2 loops in Ethernet networks with redundant paths.

STP will be covered later at the CCNA level.

Practical Troubleshooting Commands

Cisco IOS/IOS XE

A commonly used command to inspect interface status and counters is:

show interfaces

For a specific interface:

show interfaces GigabitEthernet1/0/1

This can show information such as:

• Interface state
• Line protocol state
• Speed
• Duplex
• MTU
• Input/output counters
• Errors
• CRC errors
• Drops
• Collision counters

To view a concise interface summary:

show interfaces status

To inspect MAC address learning:

show mac address-table

To inspect interface configuration:

show running-config interface GigabitEthernet1/0/1

The exact command syntax varies by Cisco platform and software release.

Windows

Display adapter configuration:

Get-NetAdapter

Display detailed adapter information:

Get-NetAdapter | Format-List *

Display IP configuration:

ipconfig /all

Test connectivity:

ping <destination>

Test a specific TCP port:

Test-NetConnection <hostname> -Port 443

Linux

Display interfaces:

ip link

Display IP addresses:

ip addr

Display link information:

ethtool eth0

Display interface statistics:

ip -s link show eth0

The interface name may differ, for example:

ens160
ens192
eth0

Real-World Scenario 1

46. A server has a 10 Gbps NIC, but file transfers are only achieving 200 Mbps. What would you investigate?

Do not immediately conclude that the NIC is faulty.

Investigate systematically:

Layer 1

• Link speed
• Optic/transceiver
• Fiber
• Cable
• Interface errors

Layer 2

• Duplex
• Interface drops
• Errors
• VLAN
• Port configuration

Layer 3

• Routing path
• MTU
• Packet loss
• Latency

Host

• CPU
• NIC driver
• TCP settings
• Disk performance
• Storage subsystem

Application

• SMB configuration
• File server performance
• Encryption
• Endpoint security inspection

Network path

• Switch uplink
• Congestion
• Firewall
• WAN bandwidth

A 10 Gbps interface only describes the link capability. It does not guarantee 10 Gbps application throughput.

Real-World Scenario 2

47. A switch interface shows increasing CRC errors. What should you check?

Start with the physical path.

Check:

1. Cable
2. Patch panel
3. SFP/transceiver
4. Fiber connectors
5. Fiber cleanliness
6. Remote interface
7. Interface hardware
8. EMI for copper environments
9. Error counters on both ends

If possible, replace components one at a time to isolate the failing component.

A CRC error is not normally solved by changing an IP address.

Real-World Scenario 3

48. A network interface is up, but performance is extremely poor and late collisions are increasing. What could be wrong?

A duplex mismatch should be investigated.

Check both ends:

Device A → Speed / Duplex
Device B → Speed / Duplex

Also investigate:

• Cable
• Interface hardware
• Negotiation settings
• Legacy equipment

Do not change configuration blindly. Verify the actual operational state on both devices.

Real-World Scenario 4

49. A fiber link between two switches is down after replacing an SFP. What would you check?

Use a structured approach:

New SFP
   ↓
Is it supported?
   ↓
Correct speed?
   ↓
Correct optic type?
   ↓
Correct fiber type?
   ↓
Correct wavelength?
   ↓
Correct TX/RX polarity?
   ↓
Fiber clean?
   ↓
Interface enabled?
   ↓
Remote optic/interface healthy?

Check the transceiver diagnostics if the platform supports them.

Do not assume that two SFPs with the same connector type are automatically compatible.

Real-World Scenario 5

50. Small packets work, but large packets fail. What should you suspect?

An MTU/PMTUD issue is one important possibility.

Investigate:

• MTU on endpoints
• MTU on interfaces
• Tunnel overhead
• Firewall behavior
• Path MTU
• ICMP filtering
• Fragmentation behavior

This symptom is particularly useful because it can indicate that basic connectivity exists while larger packets encounter a path limitation.

Interview Rapid-Fire Questions

51. What is Ethernet?

A family of wired LAN technologies standardized primarily through IEEE 802.3.

52. What is the standard Ethernet MTU commonly used on IP networks?

1500 bytes is the commonly used standard IP MTU on Ethernet.

53. What is a jumbo frame?

An Ethernet frame larger than the traditional maximum Ethernet frame size, commonly used in environments such as data centers.

54. What does FCS do?

It provides frame integrity/error detection.

55. What does CRC indicate?

It is an error-detection mechanism; a CRC error counter generally indicates received frames failing the integrity check.

56. What is full duplex?

The interface can transmit and receive simultaneously.

57. What is half duplex?

Transmission and reception cannot occur simultaneously.

58. What is an SFP?

A small-form-factor pluggable transceiver/interface module.

59. What is SFP+ commonly associated with?

10 Gigabit Ethernet implementations.

60. What is the difference between copper and fiber?

Copper uses electrical signaling; fiber uses optical signaling.

61. What does SR generally mean?

Short Reach.

62. What does LR generally mean?

Long Reach.

63. What does a switch learn from the source MAC?

It learns the source MAC-to-ingress-interface association.

64. What is MAC flapping?

Repeated learning of the same MAC address on different switch ports.

65. What does a CRC error usually make you investigate first?

The physical path, including cables, optics, connectors and interfaces.

Quick Revision

Ethernet

Ethernet
   ↓
IEEE 802.3
   ↓
Layer 1 + Layer 2

Common Ethernet speeds

10 Mbps
100 Mbps
1 Gbps
10 Gbps
25 Gbps
40 Gbps
100 Gbps
...

Physical media

Copper
   ├── Cat5e
   ├── Cat6
   └── Cat6A

Fiber
   ├── Multimode
   └── Single-mode

Ethernet frame

Destination MAC
Source MAC
EtherType/Length
Payload
FCS

Troubleshooting hierarchy

Layer 1
Cable / Fiber / Optic / Link
        ↓
Layer 2
VLAN / MAC / STP / Port
        ↓
Layer 3
IP / Routing / MTU
        ↓
Transport
TCP / UDP / Ports
        ↓
Application
DNS / HTTP / SMB / etc.

Common symptoms

Link Down
→ Physical / interface problem

CRC Errors
→ Physical path investigation

Late Collisions
→ Duplex/configuration/physical investigation

MAC Flapping
→ Layer 2 topology/configuration investigation

Small packets work, large packets fail
→ MTU/PMTUD investigation

High latency
→ Path/congestion/device/application investigation

Exam Answer Summary

What is Ethernet?

Ethernet is a family of wired LAN technologies standardized primarily under IEEE 802.3. It defines both physical transmission technologies and Layer 2 framing and addressing mechanisms.

What is MTU?

MTU is the maximum Layer 3 packet size that can normally be transmitted over an interface without fragmentation at that interface. A common Ethernet IP MTU is 1500 bytes.

What does a CRC error indicate?

It indicates that a received frame failed an integrity check. The physical path, including cable, optics, connectors and interface hardware, should be investigated.

What is a duplex mismatch?

A duplex mismatch occurs when connected Ethernet interfaces operate with incompatible duplex settings, potentially causing severe performance problems and errors.

What should you check first when a network link is down?

Start at Layer 1: physical connection, cable/fiber, transceiver, interface state and compatibility. Once Layer 1 is confirmed, proceed to Layer 2 and Layer 3.

Senior Interview Tip

When you see a network problem, don’t immediately start changing configuration.

First identify the symptom:

Is the link down?
        ↓
Are there errors?
        ↓
Is the MAC being learned?
        ↓
Is the VLAN correct?
        ↓
Is Layer 3 reachable?
        ↓
Is the required port reachable?
        ↓
Is the application working?

For a senior engineer, the important skill is not knowing hundreds of commands.

It is knowing which command to run, why you are running it, and what result would confirm or eliminate a hypothesis.

What Comes Next?

Part 4 — Network Fundamentals: IPv4 & IPv6 Addressing, Subnets, Prefixes, Private/Public Addresses & Addressing Concepts

The next part will establish the complete IP addressing foundation before we enter the formal CCNA switching and routing topics.

It will cover:

• IPv4 address structure
• Network and host portions
• Subnet masks
• CIDR notation
• Network/broadcast/host addresses
• Private vs public IPv4
• APIPA
• Loopback
• Link-local addressing
• IPv4 address classes and why classful addressing is obsolete
• IPv6 address structure
• Global unicast
• Link-local
• Unique local addresses
• Multicast
• Loopback
• IPv6 address assignment concepts
• Common addressing interview scenarios