In Part 1, we covered the basic building blocks of networking, including network devices, OSI and TCP/IP models, MAC addresses, IP addresses, frames, packets, bandwidth, latency and basic network terminology.
In this part, we will focus on a much more important practical question:
What actually happens when one computer communicates with another computer?
Understanding this process is essential for troubleshooting because a senior IT professional should be able to determine:
- Which address is used at each stage
- When MAC addresses are used
- When IP addresses are used
- When ARP is required
- When a default gateway is used
- What changes at every router hop
- What remains unchanged end-to-end
- How switches make forwarding decisions
- How routers make forwarding decisions
- How encapsulation and decapsulation occur
Networking Fundamentals Interview Questions and Answers – Part 2
1. What is the difference between logical addressing and physical addressing?
Logical addressing refers primarily to Layer 3 addressing, such as IPv4 and IPv6 addresses.
Physical/Data Link addressing refers to Layer 2 addressing, such as Ethernet MAC addresses.
For example:
MAC Address
00:11:22:33:44:55
IP Address
192.168.10.25
The MAC address is primarily used for local Layer 2 delivery, while the IP address is used for Layer 3 communication and routing.
2. Why do we need both MAC addresses and IP addresses?
They solve different problems.
MAC address
Provides Layer 2 addressing within a local network.
IP address
Provides logical Layer 3 addressing that allows communication across multiple networks.
Consider:
PC-A
192.168.10.10
|
Switch
|
Router
|
Switch
|
PC-B
192.168.20.20
MAC addresses are used for local Ethernet delivery on each link, while IP addresses identify the source and destination at Layer 3.
3. Does the destination MAC address remain the same across routers?
No.
When an IP packet crosses a router, the Layer 2 frame is removed and a new Layer 2 frame is created for the next link.
Therefore:
MAC addresses normally change at every routed hop.
The IP source and destination addresses normally remain the same end-to-end, although some technologies such as NAT can modify IP addressing.
4. Does the destination IP address change at every router?
Normally, no.
Consider:
Client → Router 1 → Router 2 → Server
The destination IP remains the server’s IP address while the packet is routed through the network.
For example:
Source IP: 192.168.10.10
Destination IP: 10.10.20.50
The destination IP remains 10.10.20.50 through normal routing.
However, technologies such as NAT can modify IP addresses.
5. What happens to the TTL when a packet crosses a router?
For IPv4, the TTL (Time To Live) value is decremented by each router that forwards the packet.
For IPv6, the equivalent field is Hop Limit.
Example:
Initial TTL = 64
Router 1 → 63
Router 2 → 62
Router 3 → 61
When the IPv4 TTL reaches zero, the packet is discarded and the router normally sends an ICMP Time Exceeded message to the source.
This mechanism helps prevent packets from circulating indefinitely because of routing loops.
6. What is encapsulation?
Encapsulation is the process of adding protocol information as data moves down the networking stack.
Example:
Application Data
↓
TCP Header + Data
↓
IP Header + TCP Segment
↓
Ethernet Header + IP Packet + Trailer
The final Ethernet frame is transmitted over the physical medium.
7. What is decapsulation?
Decapsulation is the reverse process.
At the destination:
Ethernet Frame
↓
IP Packet
↓
TCP Segment
↓
Application Data
Each layer processes the information intended for that layer and passes the remaining payload upward.
8. What is a PDU?
PDU stands for Protocol Data Unit.
It is the data unit associated with a particular networking layer or protocol.
A commonly used model is:
| Layer | PDU |
|---|---|
| Application | Data |
| Transport | Segment / Datagram |
| Network | Packet |
| Data Link | Frame |
| Physical | Bits |
PDU terminology is frequently used in networking interviews.
9. What happens when an application sends data over a network?
Consider a user accessing a web application.
The process is conceptually:
Application
↓
Transport
↓
Network
↓
Data Link
↓
Physical
Each layer adds the information required by its protocol.
For example:
HTTP Data
↓
TCP Segment
↓
IP Packet
↓
Ethernet Frame
↓
Electrical/Optical/Radio Signals
The receiving device reverses this process.
10. What is peer-to-peer communication between network layers?
Each layer conceptually communicates with the corresponding layer on the remote device.
For example:
Host A Host B
Application ←────────────→ Application
Transport ←────────────→ Transport
Network ←────────────→ Network
Data Link ←────────────→ Data Link
The actual bits travel through the physical network, but the protocol architecture allows corresponding layers to communicate logically.
ARP Fundamentals
11. What is ARP?
ARP stands for Address Resolution Protocol.
ARP is used by IPv4 hosts to determine the MAC address associated with an IPv4 address on the local network.
For example:
IP Address
192.168.10.20
↓ ARP
MAC Address
00:11:22:33:44:55
ARP operates within the local Layer 2 network.
12. Why is ARP required?
Suppose a Windows computer wants to send an Ethernet frame to:
192.168.10.20
The computer knows the destination IP address, but Ethernet requires a destination MAC address.
ARP allows the computer to discover:
192.168.10.20
↓
00:11:22:33:44:55
The host can then create an Ethernet frame addressed to that MAC address.
13. How does an ARP request work?
Suppose:
PC-A
IP: 192.168.10.10
PC-B
IP: 192.168.10.20
PC-A needs PC-B’s MAC address.
PC-A sends an ARP Request essentially asking:
Who has 192.168.10.20?
The request is sent as an Ethernet broadcast.
PC-B responds with an ARP Reply containing its MAC address.
The result is stored in the ARP cache.
14. Is an ARP request unicast or broadcast?
An ARP request is normally sent as an Ethernet broadcast on the local network.
The Ethernet destination MAC is:
ff:ff:ff:ff:ff:ff
The ARP reply is normally unicast to the requester.
15. Is ARP used for IPv6?
No.
IPv6 does not use ARP.
IPv6 uses Neighbor Discovery Protocol (NDP), which is based on ICMPv6.
NDP provides functions including:
- Neighbor discovery
- Address resolution
- Router discovery
- Duplicate Address Detection
NDP will be covered more deeply in the IPv6 portion of the curriculum.
16. What is an ARP cache?
An ARP cache stores recently learned IPv4-to-MAC mappings.
On Windows:
arp -a
Example:
Internet Address Physical Address
192.168.10.1 aa-bb-cc-dd-ee-ff
192.168.10.20 00-11-22-33-44-55
This prevents the host from needing to send a new ARP request every time it communicates with the same local destination.
17. What happens if an ARP entry is missing?
If a host needs to send IPv4 traffic to a local destination and does not have the destination MAC address cached, it normally sends an ARP request.
If a valid ARP reply is received, the host learns the MAC address and can transmit the frame.
Local and Remote Communication
18. How does a host determine whether a destination is local or remote?
The host uses its:
- Own IP address
- Subnet mask/prefix
- Destination IP address
It determines whether the destination belongs to the same IP subnet.
If the destination is local, the host attempts to resolve the destination’s Layer 2 address.
If the destination is remote, the host sends the traffic toward its default gateway.
Subnetting will be covered in detail later in the CCNA section.
19. What happens when two hosts are on the same subnet?
Suppose:
PC-A
192.168.10.10/24
PC-B
192.168.10.20/24
PC-A determines that PC-B is on the same local subnet.
PC-A therefore needs PC-B’s MAC address.
The process is approximately:
PC-A
|
| ARP Request
↓
Switch
|
| ARP Reply
↓
PC-B
PC-A then sends the Ethernet frame directly toward PC-B’s MAC address.
20. What happens when the destination is on a different subnet?
Suppose:
PC-A
192.168.10.10/24
Server
192.168.20.20/24
PC-A determines that the server is not on the local subnet.
It therefore sends the packet to its default gateway.
The Ethernet frame is addressed to the gateway’s MAC address, while the IP destination remains the remote server’s IP address.
Conceptually:
PC
↓
Default Gateway
↓
Router
↓
Remote Network
↓
Server
21. Does a host ARP for the remote server’s MAC address?
Normally, no.
If the destination is on another subnet, the host normally needs the MAC address of the next-hop gateway, not the remote server.
For example:
PC:
192.168.10.10
Gateway:
192.168.10.1
Server:
192.168.20.20
The PC normally ARPs for:
192.168.10.1
not:
192.168.20.20
22. What is the default gateway?
The default gateway is the Layer 3 next hop used by a host for destinations that are not on its local subnet.
Example:
IP Address: 192.168.10.10
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.10.1
The gateway is usually the IP address of a router or Layer 3 switch interface on the local subnet.
23. What happens if a host has no default gateway?
The host can normally communicate with devices on its local subnet, assuming other configuration is correct.
However, it generally cannot reach destinations outside its local subnet because it has no configured next hop for remote traffic.
This is an important troubleshooting clue.
Switch Forwarding
24. How does a switch learn MAC addresses?
A switch learns MAC addresses primarily by examining the source MAC address of incoming Ethernet frames.
For example:
PC-A
MAC-A
|
Port 1
|
Switch
When the switch receives a frame from PC-A on Port 1, it can learn:
MAC-A → Port 1
The switch stores this information in its MAC address table.
25. What is a MAC address table?
A MAC address table maps learned MAC addresses to switch interfaces.
Example:
MAC Address Port
00:11:22:33:44:55 Gi1/0/1
00:AA:BB:CC:DD:EE Gi1/0/2
When a frame arrives, the switch checks the destination MAC against its forwarding information.
26. What happens when a switch knows the destination MAC?
The switch forwards the frame toward the interface associated with the destination MAC address.
Example:
MAC-B → Port 2
If a frame arrives for MAC-B, the switch forwards it through Port 2 rather than sending it to every port.
27. What happens when a switch does not know the destination MAC?
For an unknown unicast destination, a switch normally floods the frame within the applicable Layer 2 forwarding domain, except back out the port on which the frame was received.
This is called unknown-unicast flooding.
The switch may learn the destination MAC later when traffic is received from that device.
28. Does a switch change the source and destination MAC addresses when forwarding a frame?
Normally, no.
A Layer 2 switch forwards the Ethernet frame without changing the source and destination MAC addresses.
A router behaves differently because it removes the incoming Layer 2 frame and creates a new Layer 2 frame for the next link.
Router Forwarding
29. How does a router decide where to send a packet?
A router examines the destination IP address and consults its routing information.
It selects the best matching route according to routing-table rules.
The selected route determines the outgoing interface and, when applicable, the next-hop address.
Routing-table concepts will be covered extensively later.
30. What is a routing table?
A routing table contains information about reachable IP networks and how to reach them.
A simplified example:
Destination Next Hop Interface
192.168.10.0/24 Direct Gi0/0
192.168.20.0/24 10.0.0.2 Gi0/1
0.0.0.0/0 10.0.0.1 Gi0/1
The router uses this information to forward packets.
31. What is longest-prefix matching?
When multiple routes match a destination IP address, a router normally selects the route with the longest matching prefix.
For example:
10.0.0.0/8
10.10.0.0/16
10.10.10.0/24
For destination:
10.10.10.50
all three prefixes may match, but:
10.10.10.0/24
is the longest and therefore the most specific match.
32. What happens to an Ethernet frame when it reaches a router?
The router receives the incoming Layer 2 frame.
Conceptually:
Incoming Frame
↓
Router removes Layer 2 encapsulation
↓
Examines IP packet
↓
Routing decision
↓
Creates new Layer 2 frame
↓
Outgoing Interface
The IP packet is then encapsulated into a new Layer 2 frame appropriate for the next network.
33. What changes when a packet crosses a router?
Under normal IP routing, the following are important:
Usually remains the same
- Source IP
- Destination IP
- Transport-layer ports
Changes at each routed hop
- Source MAC
- Destination MAC
- Layer 2 frame
- IPv4 TTL / IPv6 Hop Limit
There can be exceptions due to technologies such as NAT, tunneling, encapsulation and other network functions.
34. What is a next hop?
The next hop is the immediate Layer 3 device or destination toward which a router forwards traffic.
Example:
Router A
|
| 10.0.0.2
↓
Router B
For a route through Router B, Router B’s relevant address may be the next-hop IP.
Packet Journey Scenario
35. Explain the complete packet flow when a PC accesses a remote server.
Consider:
PC-A
IP: 192.168.10.10
Gateway: 192.168.10.1
|
|
Switch
|
|
Router R1
|
Router R2
|
Server
IP: 192.168.20.20
Step 1 — Application creates data
The application generates data for the remote server.
Step 2 — Transport layer processes the data
TCP or UDP adds the appropriate transport header.
Step 3 — IP layer creates the packet
The packet contains:
Source IP: 192.168.10.10
Destination IP: 192.168.20.20
Step 4 — Host determines destination is remote
The PC determines that 192.168.20.20 is outside its local subnet.
Step 5 — Host determines the next hop
The PC selects:
192.168.10.1
as the next hop/default gateway.
Step 6 — ARP resolves the gateway MAC
If required, the PC uses ARP to determine the MAC address of the gateway.
Conceptually:
Source MAC = PC-A
Destination MAC = Router R1
while the IP packet still contains:
Source IP = PC-A
Destination IP = Server
Step 8 — Switch forwards the frame
The switch examines the destination MAC and forwards the frame toward Router R1.
Step 9 — Router R1 processes the packet
R1:
- Receives the frame
- Removes the Layer 2 header/trailer
- Examines the IP packet
- Decrements IPv4 TTL
- Performs a routing lookup
- Selects the outgoing interface/next hop
Step 10 — R1 creates a new Layer 2 frame
The new frame contains new Layer 2 addressing appropriate for the next network segment.
The destination IP remains the server’s IP.
Step 11 — Router R2 repeats the process
R2 again:
- Receives the frame
- Removes Layer 2 encapsulation
- Performs routing
- Decrements TTL
- Creates a new Layer 2 frame
Step 12 — Server receives the traffic
The server processes the packet, passes the transport payload to the appropriate application, and generates a response.
The return traffic follows the reverse path or another valid routing path.
Important Interview Scenario
36. Why can a PC ping its gateway but not a remote server?
If the PC can reach its gateway but not a remote server, several possibilities remain.
Potential causes include:
- Missing route
- Incorrect routing
- Firewall policy
- ACL
- NAT problem
- Remote host unavailable
- Return-path problem
- Packet filtering
- Incorrect remote network configuration
The important point is:
Successful gateway connectivity proves local connectivity to the gateway; it does not prove end-to-end connectivity to the remote server.
37. Why can a PC communicate with another local PC but not the Internet?
Possible causes include:
- Missing/incorrect default gateway
- Incorrect routing
- Firewall blocking outbound traffic
- NAT failure
- Upstream router failure
- ISP connectivity problem
- DNS failure
The troubleshooting approach should isolate the failure rather than assuming a single cause.
38. If ping to 8.8.8.8 works but a website name does not work, what should you investigate?
DNS becomes a primary area of investigation.
Check:
nslookup example.com
Also verify:
- DNS server configuration
- DNS server reachability
- DNS response
- Firewall/proxy policies
- Local DNS cache
Do not conclude that the entire Internet connection is down simply because hostname resolution fails.
39. If DNS works but HTTPS does not, what could be wrong?
If DNS successfully resolves the hostname but HTTPS connectivity fails, investigate:
- TCP connectivity to port 443
- Firewall rules
- Proxy
- TLS negotiation
- Certificate problems
- Server availability
- Application-layer issues
This demonstrates an important troubleshooting principle:
Successful DNS resolution does not prove successful application connectivity.
Troubleshooting Commands
Windows
View IP configuration
ipconfig /all
View ARP cache
arp -a
Test gateway
ping <gateway-IP>
Test remote IP
ping <remote-IP>
Trace route
tracert <destination>
Test DNS
nslookup <hostname>
Test TCP connectivity
On modern Windows systems:
Test-NetConnection <hostname> -Port 443
Example:
Test-NetConnection example.com -Port 443
This is often more useful than relying only on ping when troubleshooting an application that uses TCP.
Interview Trap Questions
Here below are the list of questions.
40. Does ping always use TCP?
No.
Traditional ping uses ICMP Echo Request and Echo Reply, not TCP.
41. If ping fails, does that always mean the server is down?
No.
ICMP may be blocked by:
- Host firewall
- Network firewall
- ACL
- Security policy
- Intermediate device
The application itself may still be reachable.
42. If ping succeeds, does that mean the application is working?
No.
Ping only demonstrates successful ICMP communication.
For example:
ping server → works
TCP port 443 → blocked
HTTPS application → unavailable
Therefore, application-specific testing is necessary.
43. Does a router forward broadcasts by default?
A router does not normally forward Layer 2 broadcasts between interfaces.
This is one reason routers separate broadcast domains.
Some specific protocols or configurations can intentionally provide controlled forwarding/relaying behavior, such as DHCP relay, but that is different from simply forwarding the original Layer 2 broadcast.
44. Does a switch forward every frame to every port?
No.
A switch normally uses its MAC address table to forward known unicast traffic only toward the appropriate interface.
However, certain traffic is flooded, including:
- Broadcast frames
- Unknown unicast frames
- Some multicast traffic depending on configuration
45. Does a router use MAC addresses?
Yes, when the interface technology uses Layer 2 addressing such as Ethernet.
A common misconception is:
“Routers only use IP addresses.”
A router uses Layer 3 information to make routing decisions, but when forwarding over Ethernet it also needs Layer 2 addressing for the outgoing frame.
Real-World Troubleshooting Scenario
46. A user can ping the default gateway and 8.8.8.8, but cannot open google.com. What would you check?
A logical troubleshooting sequence is:
1. Check DNS
nslookup google.com
2. Check configured DNS servers
ipconfig /all
3. Test TCP/HTTPS
Test-NetConnection google.com -Port 443
4. Check proxy configuration
Investigate:
- Windows proxy settings
- Browser proxy
- Corporate proxy
5. Check firewall/security controls
Investigate whether HTTPS traffic is being filtered.
6. Check browser/TLS behavior
If DNS and TCP connectivity work but the browser fails, investigate:
- TLS
- Certificates
- Browser configuration
- Proxy inspection
- Application behavior
This is much better than simply saying:
“Restart the computer.”
Quick Revision
Addressing
MAC
↓
Layer 2
↓
Local Ethernet delivery
IP
↓
Layer 3
↓
Logical addressing + routing
Local destination
Host
↓
ARP destination IP
↓
Destination MAC
↓
Switch
↓
Destination
Remote destination
Host
↓
Determine remote subnet
↓
ARP default gateway
↓
Switch
↓
Router
↓
Routing
↓
New Layer 2 frame
↓
Next hop
At every routed hop
New Layer 2 frame
New source/destination MAC
TTL/Hop Limit changes
IP destination normally remains the same
Exam Answer Summary
1. What happens when a host communicates with another host on the same subnet?
The source determines that the destination is local, resolves the destination’s Layer 2 address if necessary, creates an Ethernet frame containing the destination MAC address, and sends the frame through the local Layer 2 network.
2. What happens when the destination is on another subnet?
The source determines that the destination is remote and sends the packet to its configured default gateway. The gateway/router performs a routing lookup and forwards the packet toward the destination, creating a new Layer 2 frame for each routed link.
3. What happens to MAC addresses at a router?
The incoming Layer 2 frame is removed and a new Layer 2 frame is created for the outgoing interface, so the MAC addresses normally change at every routed hop.
4. What happens to IP addresses?
Under normal routing, the source and destination IP addresses remain unchanged across routed hops, although fields such as IPv4 TTL change. NAT and other technologies can modify or encapsulate IP information.
Senior Interview Tip
When troubleshooting a network, think in terms of scope and layers.
For example:
Can I reach myself?
↓
Can I reach my local network?
↓
Can I reach my gateway?
↓
Can I reach a remote IP?
↓
Can I resolve DNS?
↓
Can I establish the required TCP/UDP connection?
↓
Can the application communicate?
This approach prevents random troubleshooting.
A senior engineer should be able to answer:
“At which point does communication stop?”
Once that point is identified, the possible causes become much narrower.
Key Concepts Covered in Part 2
By the end of this article, you should understand:
- Logical vs Layer 2 addressing
- MAC vs IP addresses
- Encapsulation
- Decapsulation
- PDUs
- ARP
- ARP cache
- Local vs remote communication
- Default gateway
- Switch MAC learning
- Unknown-unicast flooding
- Router forwarding
- Routing tables
- Longest-prefix matching
- Next-hop processing
- TTL and Hop Limit
- MAC changes at routed hops
- IP addressing across routed hops
- Broadcast domains
- Basic packet-flow analysis
- Basic network troubleshooting methodology
What Comes Next?
Part 3 — Ethernet, Physical Media, Ethernet Frames, MAC Addressing, Duplex, Speed, Auto-Negotiation, MTU & Layer-1/Layer-2 Troubleshooting
We will move from the conceptual packet journey into how Ethernet actually carries the traffic, including cables, fiber, Ethernet standards, frames, MTU, duplex, speed negotiation, interface errors and practical troubleshooting.