Interview prep · 6 questions
TCP, UDP and port interview questions
What do interviewers test with TCP and UDP questions?
They test whether you know what the transport layer adds on top of IP: reliable, ordered delivery for TCP and lightweight, connectionless delivery for UDP. They also expect the common port numbers and the difference between a refused connection and a filtered one.
Updated
Mock interview
One question at a time. Answer it out loud as you would in the room, then reveal the model answer and rate yourself honestly. Your progress stays in this browser.
What is the difference between TCP and UDP, and when would you use each?
Entry level
TCP sets up a connection and guarantees ordered, reliable delivery with acknowledgements, retransmission and flow control. UDP just sends datagrams with no setup and no guarantees, which suits short exchanges and real-time traffic where a late packet is worse than a lost one.
TCP carries web pages, file transfers, email and remote logins. UDP carries DNS queries, DHCP, time sync, voice and video calls and a lot of streaming.
When an application on UDP needs reliability, it builds its own on top, which lets it decide what is worth retransmitting.
Common weak answer: Calling UDP unreliable and stopping there. Interviewers want to hear why that is a feature for some traffic.
Likely follow-ups
- Why does DNS mostly use UDP?
- What does TCP flow control do?
- Which protocol uses both TCP and UDP, and why?
Can you walk me through the TCP three-way handshake?
Entry level
The client sends a SYN carrying its initial sequence number, the server replies with a SYN-ACK that acknowledges it and carries its own, and the client sends an ACK. After those three segments both sides have agreed on sequence numbers and data can flow both ways.
Closing is usually a four-step exchange of FIN and ACK, one pair per direction, because each direction closes separately. A RST ends a connection at once, for example when nothing is listening on the port.
An access list that allows only replies to existing connections checks for the ACK flag, which is what the "established" keyword matches.
Common weak answer: Getting the order of SYN-ACK and ACK wrong, or describing the handshake as an exchange of passwords.
Likely follow-ups
- What is a SYN flood?
- What does a RST tell you?
- Why does closing take four segments?
Which well-known port numbers should a network engineer know by heart?
Entry level
At minimum: 22 for SSH, 23 for Telnet, 25 for SMTP, 53 for DNS, 67 and 68 for DHCP, 69 for TFTP, 80 for HTTP, 123 for NTP, 161 for SNMP, 443 for HTTPS and 514 for syslog. Add 20 and 21 for FTP and 3389 for remote desktop, which come up constantly in firewall work.
Know the transport too: DNS uses UDP for most queries and TCP for zone transfers and large answers; DHCP, NTP and TFTP use UDP; SSH, HTTP and HTTPS use TCP.
Ports 0 to 1023 are the well-known range. Clients pick their source port from a high, temporary range.
Common weak answer: Knowing the numbers but not the transport. "Open port 53" is half an instruction until you say UDP, TCP or both.
Likely follow-ups
- Which port do SNMP traps use?
- Why does DNS also need TCP?
- What is an ephemeral port?
How does a server tell apart two connections from the same client?
Mid level
Each connection is identified by its five-tuple: source address, source port, destination address, destination port and protocol. Two connections from the same client to the same service differ in the client's source port, so the server and every device in between can keep them apart.
This is also what makes port address translation work: many inside hosts share one public address, and the router tells their sessions apart by rewriting and tracking source ports.
Firewalls and load balancers key their session tables on the same five fields.
Common weak answer: Saying the server uses the client's MAC address. MAC addresses do not survive the first router.
Likely follow-ups
- How does PAT use source ports?
- What happens when a PAT device runs out of ports?
- What is a socket?
What is the difference between a closed port and a filtered one?
Mid level
A closed port answers straight away: the host is reachable but nothing is listening, so TCP replies with a reset and the connection is refused. A filtered port gives no answer at all, because a firewall or access list dropped the packet, so the client waits and times out.
The difference tells you where to look. Refused means the path is fine and the service is down or on another port; a timeout points at filtering or routing along the way.
A closed UDP port normally answers with an ICMP port-unreachable message, and some firewalls send an explicit "administratively prohibited" message instead of staying silent.
Common weak answer: Treating every failed connection the same. How it fails is the most useful clue you have.
Likely follow-ups
- What does a closed UDP port send back?
- How would you test a TCP port from a host?
- Why might ping work while the service times out?
What is MTU, and what happens when a packet is bigger than the path's MTU?
Mid level
The MTU is the largest packet a link can carry in one frame, 1500 bytes on standard Ethernet. A larger packet is either fragmented by a router or, when it carries the don't-fragment flag, dropped with an ICMP message asking the sender to use smaller packets.
Path MTU discovery depends on those ICMP messages getting back. If a firewall blocks them, small packets work and large ones vanish, which looks like pings succeeding while file transfers and web pages hang.
Tunnels add headers and shrink the usable MTU, which is why tunnel interfaces are often set lower or TCP's maximum segment size is reduced on them.
Common weak answer: Saying an oversized packet is truncated. It is fragmented or dropped, never cut short.
Likely follow-ups
- How would you test the path MTU with ping?
- What is TCP's maximum segment size?
- Why does blocking all ICMP cause problems?