The OSI model is a 7-layer reference map that describes how data is prepared, addressed and delivered across a network. Each layer does one job and hands the result to the layer below it when sending, and to the layer above it when receiving.
Fig. 01 — OSI Model
Swipe sideways to see the whole diagram →
Step by step
You send data
An app hands your message to the Application layer — for example a browser sending a page request.
Headers get added
Each layer wraps the data in its own header. This wrapping is called encapsulation.
Transport splits it
TCP or UDP breaks the data into segments and stamps a port number so the right app receives it.
Network addresses it
The IP layer adds source and destination IP addresses, turning the segment into a packet.
Data Link frames it
MAC addresses are added for the next hop on the local network. Now it is a frame.
Physical transmits it
The frame becomes electrical, light or radio signals on the wire or air.
The receiver unwraps
The destination reverses the process layer by layer — decapsulation — until the app gets clean data.
Real-world example
When you open druvexaa.com, your browser works at Layer 7, TLS encryption sits around Layer 6, TCP port 443 is Layer 4, your public IP is Layer 3, your Wi-Fi adapter's MAC address is Layer 2, and the Wi-Fi radio waves are Layer 1. All seven happen before the first pixel appears.
Where people get this wrong
People memorise the seven layer names and stop there. The names are the least useful part. What matters is that a header is added at every layer on the way down and removed at every layer on the way up, so a single click produces a packet wrapped in four or five envelopes. If you cannot say which device opens which envelope, the mnemonic has not taught you anything.
Common interview questions
Why do we need a layered model at all?
Layering lets each part of the stack change independently. You can swap Wi-Fi for Ethernet at Layer 1 and 2 without rewriting the browser at Layer 7.
What is the difference between the OSI and TCP/IP models?
OSI has 7 layers and is a teaching reference. TCP/IP has 4 layers and is what the internet actually runs on. OSI's Application, Presentation and Session collapse into TCP/IP's single Application layer.
At which layer does a router work, and at which does a switch work?
A router works at Layer 3 using IP addresses. A traditional switch works at Layer 2 using MAC addresses.
What is encapsulation?
Adding a header (and sometimes a trailer) at each layer as data moves down the stack. Data becomes a segment, then a packet, then a frame, then bits.
Inside the Druvexaa simulation
The simulation builds a packet in front of you, one layer at a time, and lets you rotate it to see each header being wrapped around the payload. You can then send it across the wire and watch the receiving stack peel the layers back off in reverse.
TCP (Transmission Control Protocol) is a Layer 4 protocol that delivers data reliably and in order. It sets up a connection first, numbers every byte, waits for acknowledgements, and re-sends anything that goes missing.
Fig. 02 — TCP
Swipe sideways to see the whole diagram →
Step by step
Three-way handshake
The client sends SYN, the server replies SYN-ACK, the client answers ACK. Only now is the connection open.
Segmentation
Large data is cut into segments that fit the network's maximum size, each with a sequence number.
Acknowledgements
The receiver confirms what arrived. Anything not acknowledged in time is sent again.
Ordering
Sequence numbers let the receiver rebuild the data in the right order even if segments arrive scrambled.
Flow control
The receiver advertises a window size so a fast sender cannot flood a slow receiver.
Congestion control
TCP slows down when it detects loss, then speeds back up — this is what keeps the internet from collapsing.
Graceful close
FIN and ACK messages shut the connection down cleanly on both sides.
Real-world example
Downloading a PDF uses TCP. If one segment is lost on a weak Wi-Fi signal, TCP quietly re-sends it. You never notice — you just get a file that opens correctly instead of a corrupted one.
Where people get this wrong
The handshake gets all the attention, but almost every real TCP problem is a congestion or window problem, not a handshake problem. A connection that opens instantly and then crawls is TCP working exactly as designed — it detected loss and slowed itself down on purpose.
Common interview questions
Why is TCP called connection-oriented?
Because a handshake establishes shared state (sequence numbers, window sizes) on both ends before any data moves.
What problem does the three-way handshake solve?
It confirms both sides can send and receive, and synchronises the starting sequence numbers so ordering and loss detection work.
What is the TCP window size?
The amount of unacknowledged data the sender may have in flight. It is how TCP does flow control.
Give two applications that must use TCP.
Web browsing (HTTP/HTTPS) and email (SMTP/IMAP) — both need every byte delivered exactly once and in order.
Inside the Druvexaa simulation
Beginner mode walks the three-way handshake segment by segment with narration. Advanced mode lets you drop segments deliberately and watch retransmission, window shrinking and recovery play out on the timeline.
UDP (User Datagram Protocol) is a Layer 4 protocol that fires datagrams at a destination without a handshake, without acknowledgements and without re-sending losses. It trades reliability for speed and very low overhead.
Fig. 03 — UDP (and TCP vs UDP)
Swipe sideways to see the whole diagram →
Step by step
No setup
The sender just builds a datagram and sends it. There is no connection to establish or tear down.
Minimal header
Only source port, destination port, length and checksum — 8 bytes total against TCP's 20.
Fire and forget
The sender never learns whether the datagram arrived. There is no ACK to wait for.
Losses are accepted
A missing datagram is simply gone. For live audio, a 20 ms gap is better than a 2 second delay while it is re-sent.
The app handles the rest
If an application needs ordering or recovery, it builds that on top of UDP itself — this is what QUIC and most game engines do.
Real-world example
A video call uses UDP. If one frame is lost, you see a brief flicker and the call continues. If it used TCP, the whole call would freeze while that one lost frame was re-sent — and by the time it arrived, it would already be out of date.
Where people get this wrong
Calling UDP 'unreliable' makes people assume it loses data often. On a healthy network it rarely loses anything. Unreliable is a promise, not a prediction — UDP simply refuses to guarantee delivery, which is a very different statement from failing at it.
Common interview questions
When would you choose UDP over TCP?
When timeliness matters more than completeness: voice, video, online games, DNS lookups and live telemetry.
Why does DNS use UDP?
A query and answer usually fit in one small datagram. Setting up a TCP connection would cost more time than simply re-asking if there is no reply.
Is UDP unreliable in the sense of being faulty?
No. It is unreliable in the sense of offering no delivery guarantee. On a healthy network, almost everything arrives.
Does UDP have a checksum?
Yes, an optional checksum for corruption detection — but detecting a corrupt datagram means dropping it, not repairing it.
Inside the Druvexaa simulation
The simulation runs a TCP stream and a UDP stream side by side across the same lossy link, so you can see the TCP stream stall and recover while the UDP stream keeps flowing straight through the gap.
DNS (Domain Name System) is the internet's directory. It converts a human-friendly name like druvexaa.com into the IP address a machine actually needs to open a connection.
Fig. 04 — DNS
Swipe sideways to see the whole diagram →
Step by step
Check the caches
The browser, then the operating system, then the router check whether they already know this name. A hit ends the lookup instantly.
Ask the recursive resolver
If nothing is cached, the query goes to a resolver — usually your ISP's, or a public one like 8.8.8.8 or 1.1.1.1.
Ask a root server
The resolver asks a root server, which does not know the answer but knows which servers handle .com.
Ask the TLD server
The .com server replies with the authoritative name servers for the domain.
Ask the authoritative server
This server holds the real records and returns the A record (IPv4) or AAAA record (IPv6).
Cache and connect
The answer is cached for the length of its TTL, and the browser finally opens a TCP connection to that IP.
Real-world example
You type druvexaa.com. Within roughly 20–120 milliseconds your machine has walked this chain, received an IP address, and started the TCP handshake. Every page you have visited before skips most of the chain thanks to caching.
Where people get this wrong
The full root to TLD to authoritative walk is what gets taught, and it is the rarest case in practice. Most lookups never leave your own machine or your resolver's cache. If you time a lookup and see 2 ms, nothing walked anywhere — you hit a cache.
Common interview questions
What is the difference between a recursive and an iterative query?
A recursive resolver takes responsibility for finding the final answer. An iterative query returns a referral — 'I don't know, ask this server next'.
What is a TTL in DNS?
Time To Live: how many seconds a record may be cached before it must be looked up again. Low TTLs speed up migrations, high TTLs reduce load.
What is the difference between an A record and a CNAME?
An A record maps a name directly to an IPv4 address. A CNAME maps a name to another name, which must then be resolved.
Why is DNS a common attack target?
Because poisoning a cache or hijacking a record silently redirects real users to a fake server while the address bar still looks correct.
Inside the Druvexaa simulation
You can clear each cache layer independently in the simulation and re-run the lookup, which makes the difference between a 2 ms cached answer and a full recursive walk immediately visible.
DHCP (Dynamic Host Configuration Protocol) hands out IP configuration automatically. When a device joins a network it receives an IP address, subnet mask, default gateway and DNS server without anyone typing anything.
Fig. 05 — DHCP
Swipe sideways to see the whole diagram →
Step by step
Discover
The new device has no IP yet, so it broadcasts a DHCP DISCOVER to the whole local network.
Offer
Any DHCP server that hears it reserves a free address and replies with a DHCP OFFER.
Request
The client picks one offer (usually the first) and broadcasts a REQUEST naming that server, so other servers release their reservations.
Acknowledge
The chosen server sends an ACK containing the address, subnet mask, gateway, DNS servers and lease time.
Use and renew
The client starts using the address and tries to renew the lease at 50% of its lifetime, long before it expires.
Real-world example
You connect your phone to a café's Wi-Fi. Within about a second the DORA exchange completes and your phone has an address like 192.168.1.42, a gateway of 192.168.1.1 and working DNS — with zero configuration from you.
Where people get this wrong
DORA is usually memorised as four steps in a straight line. The part that actually matters is why REQUEST is broadcast rather than sent quietly to the chosen server — it is how every other DHCP server on the segment learns to release the address it had reserved for you.
Common interview questions
What does DORA stand for?
Discover, Offer, Request, Acknowledge — the four messages of a DHCP lease.
Why are DISCOVER and REQUEST broadcast rather than unicast?
The client has no IP address yet and does not know the server's address, so it cannot address anyone directly.
What is a DHCP relay agent?
A router feature that forwards DHCP broadcasts to a server on another subnet, so one server can serve many VLANs.
What is a DHCP reservation?
A permanent mapping of a MAC address to a specific IP, so a printer or server always gets the same address while still using DHCP.
Inside the Druvexaa simulation
The simulation places two DHCP servers on one network so you can watch both make an offer, see which one the client accepts, and see the losing server withdraw its reservation the moment the broadcast REQUEST goes out.
ARP (Address Resolution Protocol) finds the MAC address that belongs to a known IP address on the local network. Without it, a device knows where to send data logically but not physically.
Fig. 06 — ARP
Swipe sideways to see the whole diagram →
Step by step
Check the ARP cache
The sender first looks in its own ARP table. A recent entry means no broadcast is needed.
Broadcast the request
If there is no entry, the device sends an ARP Request to the broadcast MAC ff:ff:ff:ff:ff:ff — every device on the LAN receives it.
Only the owner replies
Devices with a different IP ignore it. The device that owns the IP sends a unicast ARP Reply with its MAC address.
Cache the answer
Both sides store the mapping in their ARP table for a few minutes so the next frame goes out immediately.
Build the frame
The MAC address goes into the Ethernet frame header and the data is finally transmitted.
Real-world example
Your laptop wants to reach the printer at 192.168.1.50. It shouts 'who has 192.168.1.50?' across the LAN. The printer answers with its MAC address, the laptop caches it, and every page you print for the next few minutes goes straight there.
Where people get this wrong
Students often assume ARP happens once per conversation. It happens once per cache lifetime, and the cache is short. It also does not happen for remote destinations at all — you ARP for the gateway instead, which is why an ARP capture on a busy machine looks far quieter than expected.
Common interview questions
Which OSI layers does ARP sit between?
It bridges Layer 3 (IP) and Layer 2 (MAC). It is usually described as a Layer 2.5 protocol.
What is ARP spoofing?
An attacker sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, putting the attacker in the middle of the traffic.
What is Gratuitous ARP?
An unsolicited ARP announcement a device sends about itself — used to detect IP conflicts and to update switches after a failover.
Does ARP cross a router?
No. ARP is confined to a single broadcast domain. To reach another network you ARP for the default gateway's MAC instead.
Inside the Druvexaa simulation
The frame inspector lets you open any Ethernet frame on the wire and read its header fields, so you can watch the destination MAC change from the broadcast address to the real one the instant the reply arrives.
NAT (Network Address Translation) rewrites private IP addresses into a public one so devices inside a home or office can reach the internet. PAT (Port Address Translation) is the common form of NAT that lets many devices share a single public IP by also tracking port numbers.
Fig. 07 — NAT and PAT
Swipe sideways to see the whole diagram →
Step by step
A private device sends out
Your laptop uses a private address (192.168.x.x, 10.x.x.x or 172.16–31.x.x) which is not routable on the internet.
The router rewrites the source
As the packet leaves, the router replaces the private source IP with its own public IP and swaps the source port for a unique one.
An entry is stored
The pairing of private IP, private port, public port and destination is written into the NAT translation table.
The server replies
The remote server answers to the public IP and port. It has no idea a private network exists.
The router translates back
The router looks up the port in its table, rewrites the destination back to the private address, and delivers it to the right device.
Real-world example
Five phones, two laptops and a smart TV in one house all browse at the same time through a single public IP from your ISP. PAT keeps them apart purely by port number — that is why your router can hold thousands of simultaneous conversations on one address.
Where people get this wrong
NAT is often described as hiding your IP for privacy. That is a side effect, not the purpose. NAT exists because IPv4 ran out of addresses, and the privacy it appears to give disappears the moment you log into anything.
Common interview questions
What is the difference between NAT and PAT?
Static NAT maps one private IP to one public IP. PAT (also called NAT overload) maps many private IPs to one public IP by tracking port numbers.
Why was NAT invented?
IPv4 has only about 4.3 billion addresses. NAT let millions of devices share a handful of public addresses and delayed IPv4 exhaustion by decades.
What problems does NAT cause?
It breaks end-to-end connectivity. Incoming connections need port forwarding, and peer-to-peer protocols need workarounds like STUN or hole punching.
Does IPv6 need NAT?
Generally no. The address space is large enough for every device to have a globally routable address, so NAT is used only in specific cases.
Inside the Druvexaa simulation
The translation table is shown live as a scrolling panel. Open several connections from different devices at once and watch rows appear, each with a different outside port, then watch them expire when the connections close.
IPv4 is the fourth version of the Internet Protocol and still carries most internet traffic. It uses a 32-bit address written as four numbers from 0 to 255, such as 192.168.1.1, giving roughly 4.3 billion unique addresses.
Fig. 08 — IPv4
Swipe sideways to see the whole diagram →
Step by step
Four octets
The 32 bits are split into four 8-bit groups, each written in decimal from 0 to 255 and separated by dots.
Network and host
A subnet mask (or CIDR suffix like /24) marks where the network part ends and the host part begins.
Private ranges
10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are reserved for internal use and never routed on the public internet.
Special addresses
The first address in a subnet is the network address and the last is the broadcast address, so neither can be assigned to a device.
Assignment
Addresses arrive either statically (typed in by an admin) or dynamically through DHCP.
Exhaustion and NAT
The regional pools ran out. NAT and PAT keep IPv4 usable by letting whole networks share one public address.
Real-world example
Your home router almost certainly uses 192.168.1.1 with a /24 mask. That subnet holds 256 addresses: one network address, one broadcast address, and 254 usable ones for your phones, laptops and TV.
Where people get this wrong
The subnet mask is treated as a setting to copy rather than a calculation. Until you can look at 192.168.1.10/26 and say which addresses are on your side of the boundary, subnetting questions in interviews will keep going wrong.
Common interview questions
How many usable hosts does a /24 subnet have?
254. There are 256 total addresses, minus the network address and the broadcast address.
What is CIDR?
Classless Inter-Domain Routing — writing the mask as a prefix length like /26 instead of using the old fixed Class A, B and C boundaries.
Why can a private IP not be used on the internet?
Public routers are configured to drop private ranges. They are reusable inside millions of separate networks, so they are ambiguous globally.
What is 127.0.0.1?
The loopback address. Traffic sent there never leaves the machine and is handled by the local network stack.
Inside the Druvexaa simulation
The addressing view lets you drag the prefix length and watch the network and host portions of the address redraw in real time, along with the usable host count for that mask.
IPv6 is the successor to IPv4. It uses a 128-bit address written in hexadecimal, such as 2001:0db8:85a3::8a2e:0370:7334, which provides an address space so large that every device on Earth can have a globally routable address.
Fig. 09 — IPv6
Swipe sideways to see the whole diagram →
Step by step
Eight hex groups
The 128 bits are written as eight groups of four hexadecimal digits, separated by colons.
Shortening rules
Leading zeros in a group can be dropped, and one run of all-zero groups can be replaced with :: — but only once per address.
Prefix and interface ID
Typically the first 64 bits identify the network and the last 64 identify the device.
Address types
Global unicast addresses are internet-routable, link-local addresses (fe80::/10) work only on the local segment, and multicast replaces IPv4 broadcast entirely.
Autoconfiguration
With SLAAC a device can build its own address from the router's advertised prefix — no DHCP server required.
Dual stack
Most networks run IPv4 and IPv6 side by side during the transition, so a device holds addresses of both kinds.
Real-world example
Open an IPv6 test page on a modern mobile network in India and you will usually see a global address starting 2401: or 2409:. Your phone reached that site without any NAT translation at all — the address it used is the address the server saw.
Where people get this wrong
The common assumption is that IPv6 is IPv4 with longer addresses. The bigger changes are structural: broadcast is gone entirely, ARP is replaced, and a device can configure itself without a DHCP server at all.
Common interview questions
Why was IPv6 created?
IPv4's 32-bit space ran out. IPv6 also simplifies the header, removes broadcast, and builds in autoconfiguration and stronger multicast support.
What replaces ARP in IPv6?
NDP, the Neighbour Discovery Protocol, which uses ICMPv6 Neighbour Solicitation and Advertisement messages instead of broadcasts.
What is a link-local address?
An fe80::/10 address that every IPv6 interface generates automatically. It is valid only on that link and is never routed.
What is dual stack?
Running IPv4 and IPv6 simultaneously on the same device or network so it can talk to both old and new destinations.
Inside the Druvexaa simulation
The simulation runs the same request over IPv4 with NAT and over IPv6 without it, side by side, so the extra translation step in the IPv4 path is visible rather than described.
A router is a Layer 3 device that moves packets between different networks. It reads the destination IP address, consults its routing table, and forwards the packet toward the best next hop.
Fig. 10 — Router
Swipe sideways to see the whole diagram →
Step by step
Receive the frame
The router strips the Layer 2 frame to expose the IP packet inside.
Read the destination IP
It examines only the destination address, not the contents of the data.
Look up the routing table
It finds the entry whose prefix matches the destination most specifically — the longest prefix match wins.
Decrement the TTL
The Time To Live field drops by one. If it reaches zero the packet is discarded, which prevents infinite loops.
Build a new frame
A fresh Layer 2 header is created with the MAC address of the next hop. The IP addresses stay the same.
Forward it
The packet is sent out of the chosen interface and the next router repeats the process until it arrives.
Real-world example
Your home router is doing several jobs at once: routing packets to your ISP, acting as the default gateway for your LAN, running a DHCP server, performing NAT, and usually serving Wi-Fi. Enterprise routers separate these roles across dedicated devices.
Where people get this wrong
People picture the router examining the whole packet. It reads the destination address, decrements a counter, and moves on. Everything else in the packet is untouched — which is exactly why routing scales to internet size.
Common interview questions
What is the difference between a router and a switch?
A switch forwards frames within one network using MAC addresses. A router forwards packets between networks using IP addresses.
What is longest prefix match?
When several routes match a destination, the router picks the one with the most specific mask — /28 beats /24, which beats the default /0.
What is a default route?
0.0.0.0/0 — the route used when nothing more specific matches. On a home network it points at the ISP.
What is the difference between static and dynamic routing?
Static routes are typed in manually. Dynamic routing protocols like OSPF and BGP let routers learn and update routes automatically as the network changes.
Inside the Druvexaa simulation
The simulation opens the routing table as a readable panel and highlights which entry won the longest prefix match for each packet, so the forwarding decision stops being a black box.
The default gateway is the address a device sends traffic to when the destination is outside its own subnet. It is the door out of the local network — usually the LAN-facing interface of your router.
Fig. 11 — Default Gateway
Swipe sideways to see the whole diagram →
Step by step
Compare with the subnet mask
The sender ANDs the destination IP with its own subnet mask to decide whether the target is local or remote.
Local destination
If it is local, the device ARPs for the target's MAC address and sends the frame straight to it. The gateway is never involved.
Remote destination
If it is remote, the device instead ARPs for the gateway's MAC address.
Addressing splits
The frame carries the gateway's MAC but the packet still carries the final destination's IP. Layer 2 changes hop by hop, Layer 3 does not.
The router takes over
The gateway receives the frame, routes the packet onward, and the process repeats at each hop.
Real-world example
Pinging another laptop on your Wi-Fi never touches the router's routing logic — the traffic goes directly between the two devices. Opening a website does, because the destination is outside your subnet and must leave through the gateway.
Where people get this wrong
The gateway is assumed to be involved in all traffic. It is involved in none of your local traffic. Two machines on the same subnet talk directly, and a completely wrong gateway address will not affect them at all — which is why 'local works, internet does not' is such a reliable diagnostic signal.
Common interview questions
What happens if the default gateway is wrong?
Local traffic still works perfectly, but nothing outside the subnet is reachable. This is the classic symptom of a misconfigured gateway.
How does a device learn its default gateway?
Usually from the DHCP ACK message, or from a static configuration typed in manually.
Can a device have more than one default gateway?
It can have multiple, but it will normally prefer one based on metric. Two active default routes commonly cause unpredictable routing.
Does the gateway's MAC address change as the packet travels?
Yes. Every hop rewrites the Layer 2 header. The source and destination IP addresses stay the same end to end.
Inside the Druvexaa simulation
The simulation lets you set a deliberately wrong gateway and then ping both a local and a remote host, so you can see one succeed and the other fail for a reason you can trace on screen.
A switch is a Layer 2 device that forwards Ethernet frames only to the port where the destination device actually lives. It learns which MAC address sits behind each port and builds a MAC address table to make that decision.
Fig. 12 — Switch
Swipe sideways to see the whole diagram →
Step by step
A frame arrives
The switch reads the source MAC address and records it against the incoming port. This is how it learns.
Look up the destination
It checks the destination MAC in its table to find the matching port.
Forward
If the MAC is known, the frame is sent out that one port only — no other device sees it.
Flood if unknown
If the MAC is not in the table yet, the frame goes out every port except the one it arrived on. The reply teaches the switch where that device is.
Age out entries
Table entries expire after a few minutes so the switch adapts when devices move.
Real-world example
On a switched office network you cannot casually sniff a colleague's traffic, because frames addressed to their MAC never reach your port. On the old hub-based networks they reached everyone.
Where people get this wrong
A switch is often described as knowing where every device is. It knows nothing when it powers on. Everything in its table was learned by watching source addresses on frames that arrived — and it forgets all of it if the device stays quiet for a few minutes.
Common interview questions
What is the difference between a hub and a switch?
A hub repeats every frame to every port and creates one shared collision domain. A switch forwards selectively and gives each port its own collision domain.
What is MAC flooding?
An attack that fills the switch's MAC table with fake addresses so it starts flooding all frames, turning the switch into a hub the attacker can sniff.
What is a Layer 3 switch?
A switch that can also route between VLANs at hardware speed, combining Layer 2 forwarding with Layer 3 routing.
Why is a switch full duplex?
Because each port is a dedicated link, so a device can send and receive at the same time without collisions.
Inside the Druvexaa simulation
The MAC address table is displayed as a live panel. Send the first frame from a silent device and watch the switch flood it everywhere, then watch the table fill in and the next frame go to exactly one port.
A hub is a Layer 1 device that repeats every incoming signal out of every other port. It has no addressing intelligence at all — it simply copies electrical signals, which is why it has been replaced by switches.
Fig. 13 — Hub
Swipe sideways to see the whole diagram →
Step by step
Signal arrives
An electrical signal comes in on one port.
Amplify and repeat
The hub regenerates the signal and pushes it out of every other port.
Everyone receives
All connected devices get the frame regardless of who it was meant for.
The NIC filters
Each device's network card compares the destination MAC to its own and silently drops frames that are not for it.
Collisions happen
Because everyone shares one collision domain, two devices sending at once corrupt each other's signal and both must back off and retry.
Real-world example
Ten devices on a 100 Mbps hub share 100 Mbps between them and constantly interrupt each other. Ten devices on a 100 Mbps switch each get their own 100 Mbps full-duplex link. That difference is why hubs vanished from real networks.
Where people get this wrong
Hubs are dismissed as obsolete trivia, but they are the clearest way to understand what a collision domain is. Every argument for why switches exist is really an argument about what a hub does wrong.
Common interview questions
Which OSI layer does a hub operate at?
Layer 1, the physical layer. It deals in signals, not addresses.
What is a collision domain?
A network segment where two simultaneous transmissions interfere. A hub gives all its ports one shared collision domain.
What is CSMA/CD?
Carrier Sense Multiple Access with Collision Detection — the rule that made hub networks workable: listen before sending, detect collisions, wait a random time, retry.
Are hubs ever still useful?
Occasionally in labs for packet capture, since they naturally mirror all traffic to every port.
Inside the Druvexaa simulation
The simulation lets you force two devices to transmit at the same instant and watch the collision happen, the back-off timer start, and the retry succeed — the moment that made switched networks inevitable.
A MAC address is the 48-bit hardware identifier burned into a network interface. It is written as six hexadecimal pairs like 00:1A:2B:3C:4D:5E and is used to deliver frames within a single local network.
Fig. 14 — MAC Address
Swipe sideways to see the whole diagram →
Step by step
Assigned at manufacture
The first 24 bits (the OUI) are allocated to the vendor by the IEEE. The remaining 24 bits are chosen by the vendor per device.
Stored on the NIC
The address lives in the network card's firmware, which is why it is called a physical or burned-in address.
Used inside the LAN
Every Ethernet and Wi-Fi frame carries a source and destination MAC so switches know where to send it.
Discovered by ARP
A device with only an IP address uses ARP (or NDP in IPv6) to find the matching MAC.
Can be changed in software
Modern operating systems can override the burned-in value. Phones randomise MAC addresses per network to resist tracking.
Real-world example
Your phone shows a different MAC address to your home Wi-Fi than to a café's Wi-Fi. That is MAC randomisation, added specifically so shops cannot track your movements by watching for one fixed hardware address.
Where people get this wrong
A MAC address is often treated as proof of identity. Any modern operating system can present a different one in a single command, and phones already change theirs per network by default. It identifies an interface on a segment, nothing more.
Common interview questions
What is the difference between a MAC address and an IP address?
A MAC address is physical, flat and local to one network segment. An IP address is logical, hierarchical and routable across the internet.
What is the broadcast MAC address?
ff:ff:ff:ff:ff:ff — every device on the segment accepts a frame sent to it. ARP requests use it.
Is a MAC address really permanent?
The burned-in one is, but the operating system can present a different value. Never treat a MAC as proof of identity.
Why do switches need MAC addresses but routers need IP addresses?
Switches make local delivery decisions inside one broadcast domain. Routers need hierarchy to scale across the whole internet, which flat MAC addressing cannot provide.
Inside the Druvexaa simulation
The frame view shows the source and destination MAC in the header of every frame crossing the wire, so you can watch the destination change at each hop while the IP addresses stay fixed.
A VLAN (Virtual LAN) splits one physical switch into several logically separate networks. Devices in different VLANs cannot talk to each other directly, even when they are plugged into the same switch.
Fig. 15 — VLAN
Swipe sideways to see the whole diagram →
Step by step
Assign ports to VLANs
Each access port is configured to belong to one VLAN, so the device plugged into it joins that logical network.
Broadcast isolation
A broadcast from VLAN 10 reaches only VLAN 10 ports. Other VLANs never see it, which cuts broadcast noise dramatically.
Tagging on trunks
Links between switches carry many VLANs at once. An 802.1Q tag is inserted into each frame to say which VLAN it belongs to.
Tag removal
When the frame reaches its destination access port, the tag is stripped and the end device receives a normal untagged frame.
Inter-VLAN routing
To let VLANs communicate you route between them at Layer 3, which also gives you a natural place to apply access control.
Real-world example
A college puts staff, students and guest Wi-Fi on three VLANs. All three share the same switches and cabling, but a student device cannot reach the staff file server at Layer 2 at all — the separation is enforced by the network, not by a password.
Where people get this wrong
VLANs are often thought of as a security feature on their own. They are a separation feature. Two VLANs are isolated until you route between them — and the moment you do, whatever access control you put on that routing point is the only thing protecting them.
Common interview questions
Why use VLANs instead of separate physical switches?
Cost and flexibility. You get the same isolation without buying separate hardware, and you can move a user between VLANs with a configuration change.
What is the difference between an access port and a trunk port?
An access port carries one untagged VLAN to an end device. A trunk port carries many VLANs between switches using 802.1Q tags.
What is the native VLAN?
The one VLAN whose frames cross a trunk untagged. Mismatched native VLANs on the two ends of a trunk cause traffic to leak between VLANs.
Can two VLANs share the same IP subnet?
They should not. Each VLAN is normally mapped to its own subnet, because a VLAN is a broadcast domain and a subnet is a Layer 3 boundary.
Inside the Druvexaa simulation
You can move a port between VLANs in the simulation and immediately retry a ping, so the isolation stops being a claim and becomes something you watched happen.
Networks are classified by the area they cover. A PAN spans a few metres, a LAN a building, a MAN a city, and a WAN a country or the whole planet.
Fig. 16 — PAN, LAN, MAN and WAN
Swipe sideways to see the whole diagram →
Step by step
PAN
Bluetooth earbuds, a smartwatch and a phone form a personal area network measured in metres.
LAN
A home or office network built from switches and Wi-Fi access points, owned entirely by one organisation.
CAN
A campus area network links several nearby buildings — effectively a group of LANs under one owner.
MAN
A metropolitan network connects sites across a city, usually over fibre leased from or run by a provider.
WAN
A wide area network spans cities and countries. Links are leased from carriers rather than owned, so cost and latency rise sharply.
Speed falls as distance grows
Generally a LAN offers the highest speed and lowest latency; a WAN offers the widest reach but more delay and more cost per megabit.
Real-world example
Your earbuds connect over a PAN to your phone. Your phone connects over a LAN to your home Wi-Fi. Your ISP aggregates the neighbourhood over what is effectively a MAN. Reaching a server in Singapore uses a WAN. Four network types in one ordinary moment.
Where people get this wrong
The four acronyms are usually memorised by distance alone. The more useful distinction is ownership: you own a LAN and can change anything in it, while a WAN is leased, which is why WAN problems are diagnosed so differently from LAN problems.
Common interview questions
Which network type has the lowest latency and why?
A PAN or LAN, because the physical distance and the number of intermediate devices are both small.
Who owns a WAN?
Usually a service provider. Organisations lease capacity across it rather than owning the infrastructure.
Is the internet a WAN?
It is the largest WAN — a global interconnection of countless autonomous networks.
What technology typically builds a MAN?
Metro Ethernet or fibre rings run by a city carrier, connecting multiple sites at high speed across a metropolitan area.
Inside the Druvexaa simulation
The simulation zooms continuously from a pair of earbuds out to satellite scale, so the jump from metres to thousands of kilometres is something you experience rather than read in a table.
Wi-Fi carries network frames over radio waves instead of cables. An access point converts between wired Ethernet and 802.11 radio signals so devices can join the LAN without plugging in.
Fig. 17 — Wi-Fi work
Swipe sideways to see the whole diagram →
Step by step
The AP beacons
The access point broadcasts beacon frames advertising its SSID, supported speeds and security type.
Your device scans
It listens across channels, builds a list of networks, and picks one based on signal strength and saved profiles.
Authenticate and associate
The device proves it knows the passphrase (WPA2/WPA3) and is then associated with the AP.
Get an address
DHCP runs and the device receives an IP, gateway and DNS servers.
Frames become radio
Data is modulated onto a 2.4 GHz, 5 GHz or 6 GHz carrier and transmitted. The AP converts it back to Ethernet on the wire.
Share the air
Only one device transmits on a channel at a time, so the AP coordinates access. This is why a crowded channel feels slow even with full signal bars.
Real-world example
Full signal bars but slow internet is usually a channel congestion problem, not a coverage problem. Twelve neighbours on the same 2.4 GHz channel are all taking turns to speak in the same room.
Where people get this wrong
Signal bars are read as speed. They measure signal strength, not available capacity. Full bars on a channel shared with a dozen neighbouring networks will be slower than two bars on a clear one.
Common interview questions
What is the difference between 2.4 GHz and 5 GHz?
2.4 GHz travels further and passes through walls better but is crowded and slower. 5 GHz is much faster with more clean channels but has shorter range.
What is an SSID?
The network name an access point advertises. Several APs can share one SSID to form a single roaming network.
Why does Wi-Fi use CSMA/CA instead of CSMA/CD?
A radio cannot reliably listen while transmitting, so it avoids collisions in advance rather than detecting them after the fact.
What improved in WPA3 over WPA2?
Stronger key exchange that resists offline password guessing, plus individual encryption on open networks.
Inside the Druvexaa simulation
The radio view shows several access points transmitting on overlapping channels, so you can watch airtime being shared and see throughput fall as more devices join the same channel.
Bandwidth is how much data can move per second. Latency is how long one piece of data takes to arrive. A connection can have huge bandwidth and still feel slow if latency is high.
Fig. 18 — Difference between Bandwidth and Latency
Swipe sideways to see the whole diagram →
Step by step
Bandwidth is capacity
A 300 Mbps link can carry 300 megabits every second, regardless of how far away the server is.
Latency is delay
Round-trip time is what ping measures. It comes from distance, the speed of light in fibre, and processing at each hop.
They are independent
A satellite link can have high bandwidth and 600 ms latency. A short fibre link can have modest bandwidth and 4 ms latency.
Jitter is variation
Latency that fluctuates causes choppy calls even when the average is fine. Video apps add buffers to absorb it.
Throughput is what you actually get
Real transfer speed after protocol overhead, congestion and packet loss are taken into account.
Diagnose correctly
A slow download points at bandwidth. A laggy game or a delayed call points at latency and jitter.
Real-world example
Buying a faster plan will not fix your ping in an online game if the server is in another country. Distance sets a floor on latency that no amount of bandwidth can remove.
Where people get this wrong
Upgrading the connection is the standard response to anything feeling slow. Bandwidth fixes downloads. It does almost nothing for a laggy call or a game, where distance and jitter set the floor and no plan upgrade can move it.
Common interview questions
Can increasing bandwidth reduce latency?
Only indirectly, by relieving congestion. The base propagation delay is set by distance and cannot be bought away.
What is jitter?
The variation in latency between packets. Constant delay is manageable; unpredictable delay ruins real-time audio and video.
What is RTT?
Round Trip Time — how long a packet takes to reach a destination and for the reply to come back. Ping reports it.
Why does a large file transfer over a high-latency link underperform?
TCP must wait for acknowledgements. With a small window and long RTT the link sits idle, which is why window scaling matters on long-distance links.
Inside the Druvexaa simulation
The simulation lets you set bandwidth and latency independently, then run a file transfer and a live call across the same link, so you can see which one each setting actually affects.
Load balancing spreads incoming requests across several servers so no single machine is overwhelmed. Failover is the related mechanism that redirects traffic away from a server that has stopped responding.
Fig. 19 — Load Balancing and Server Switching
Swipe sideways to see the whole diagram →
Step by step
Requests hit one address
Users connect to a single public address that belongs to the load balancer, not to any individual server.
Pick a backend
An algorithm chooses a server — round robin, least connections, or weighted by capacity.
Health checks run continuously
The balancer probes each server every few seconds. A server that fails several probes is marked unhealthy.
Traffic is redirected
New requests skip the unhealthy server entirely. Users see no error because the failure never reaches them.
Sessions are preserved
Sticky sessions or a shared session store keep a logged-in user working even if their requests move between servers.
Recovery is automatic
When the server passes health checks again it is quietly returned to the pool.
Real-world example
During a big sale, an e-commerce site adds servers behind the same balancer. Users never learn which machine served them — and when one crashes at peak load, the next click simply lands somewhere else.
Where people get this wrong
Load balancing is assumed to be about speed. Its more important job is that a server can die at peak load and nobody finds out. Health checks are the part that does that work, and they are the part that gets configured carelessly.
Common interview questions
What is the difference between Layer 4 and Layer 7 load balancing?
Layer 4 balances on IP and port without inspecting content. Layer 7 reads the HTTP request, so it can route by URL, header or cookie.
What is a health check?
A periodic probe that decides whether a backend is fit to receive traffic. Without it, the balancer keeps sending users to a dead server.
What is a sticky session?
Binding a user to one backend for the life of their session, usually via a cookie, so server-local state is not lost.
How is load balancing different from failover?
Load balancing shares work across servers that are all active. Failover switches to a standby when the primary dies. Most modern setups do both.
Inside the Druvexaa simulation
You can kill a backend server mid-request in the simulation and watch the health check fail, the balancer remove it from the pool, and traffic continue on the remaining servers without a single visible error.
In a bus topology every device connects to one shared backbone cable. Data travels along the whole cable and terminators at both ends absorb the signal to stop it reflecting back.
Fig. 20 — Bus Topology
Swipe sideways to see the whole diagram →
Step by step
One shared cable
All devices tap into a single backbone, so the cabling cost is the lowest of any topology.
Signals travel both ways
A transmission spreads along the entire cable and reaches every device.
Only the target accepts
Each network card checks the destination address and ignores frames not meant for it.
Terminators absorb the signal
Without a terminator at each end the signal bounces back and corrupts the next transmissions.
Collisions and fragility
Two devices sending at once collide, and a single break in the backbone takes the whole network down.
Real-world example
Early 10BASE-2 office networks used a coaxial bus. One loose connector in the middle of the run knocked out everyone downstream, which is exactly why star topology with a switch replaced it.
Where people get this wrong
Bus topology is written off as history, but the reason it failed is still the most important lesson in it: shared media means shared failure. Every wireless network you use today is a shared medium with the same underlying problem, solved differently.
Common interview questions
What is the biggest weakness of bus topology?
A single point of failure. One break in the backbone splits or disables the whole network.
Why are terminators required?
To absorb the signal at each end. Without them, reflections travel back down the cable and corrupt data.
How does bus topology handle collisions?
With CSMA/CD — devices listen before sending, detect collisions, back off for a random interval and retry.
What is the one real advantage of bus topology?
Very low cable cost and simple installation for a small number of devices.
Inside the Druvexaa simulation
Remove a terminator in the simulation and watch the signal reflect back down the cable and corrupt the next transmission — the failure mode that made these networks so frustrating to run.
In a star topology every device has its own dedicated link to a central switch. It is the layout used by almost every modern wired network because a single cable fault affects only one device.
Fig. 21 — Star Topology
Swipe sideways to see the whole diagram →
Step by step
A central device
A switch (historically a hub) sits at the centre and every host connects to it individually.
Dedicated links
Each device gets its own full-duplex cable, so it does not share bandwidth with its neighbours.
Forwarding decisions
The switch reads the destination MAC and sends the frame out only the correct port.
Fault isolation
If one cable fails, only that one device drops off. Everyone else keeps working.
Easy growth
Adding a device means plugging into a free port, or stacking another switch when ports run out.
Real-world example
Every office network you have used is a star: wall ports run back to a switch in a rack. Unplugging your own cable never affects the person sitting next to you.
Where people get this wrong
The central switch is described as a single point of failure and then ignored. In real designs that is the entire problem worth solving, and it is why every serious network has redundant uplinks and a second switch.
Common interview questions
What is the main disadvantage of star topology?
The central switch is a single point of failure — if it dies, every device connected to it loses the network.
Why does star topology scale better than bus?
Dedicated links remove collisions, and adding a device does not disturb existing traffic.
What is an extended star?
Switches connected to other switches, forming a hierarchy — the standard design for multi-floor buildings.
How is redundancy added to a star?
Redundant uplinks and a second switch, with a protocol like STP or a link aggregation group preventing loops.
Inside the Druvexaa simulation
Cut one cable in the simulation and watch a single device drop off while everything else continues. Then take out the switch and watch the whole segment go dark at once.
In a ring topology each device connects to exactly two neighbours, forming a closed loop. Data travels around the ring in one direction, passing through each device until it reaches its destination.
Fig. 22 — Ring Topology
Swipe sideways to see the whole diagram →
Step by step
Devices form a loop
Every node has one upstream and one downstream neighbour, and the last node connects back to the first.
Data moves one way
Frames circulate in a single direction, so there is a predictable path from any node to any other.
Each node repeats
A node that is not the destination regenerates the signal and passes it on, which keeps the signal strong over long runs.
Token passing
In classic Token Ring, a special token grants the right to transmit. Only the token holder may send, so collisions are impossible.
Dual rings for resilience
Technologies like FDDI use a second counter-rotating ring, so a single break can be healed by wrapping traffic onto the backup ring.
Real-world example
Ring designs are rare on the desktop today but common in provider networks, where fibre metro rings give a city two independent paths between exchanges — a cut on one side still leaves a working route.
Where people get this wrong
Token passing is remembered as a slow, dated idea. It was chosen for a reason that still matters: it makes the maximum wait time predictable, which is worth more than raw speed in industrial and real-time systems.
Common interview questions
What is the main weakness of a single ring?
One broken link or failed node breaks the loop and can take the whole ring down.
Why does token passing avoid collisions?
Only the device holding the token may transmit, so two devices can never send at the same time.
Is ring performance predictable?
Yes. Token passing gives a deterministic maximum wait time, which is why it suited industrial and real-time networks.
What is a dual ring?
Two rings running in opposite directions. If one path fails, traffic wraps onto the other and the ring stays up.
Inside the Druvexaa simulation
The token is drawn as a visible object circulating the ring, so you can see a device waiting for it, taking it, transmitting, and releasing it to the next node.
In a mesh topology devices connect directly to many or all other devices. It gives the highest fault tolerance of any layout, at the cost of a very large number of links.
Fig. 23 — Mesh Topology
Swipe sideways to see the whole diagram →
Step by step
Direct links everywhere
In a full mesh every node has a dedicated link to every other node.
Link count grows fast
n devices need n(n-1)/2 links. Six nodes need 15 links; twenty nodes would need 190.
Multiple paths exist
If one link fails, traffic simply takes another route. There is no single point of failure.
No shared bottleneck
Traffic between two nodes does not consume capacity on the links between other pairs.
Partial mesh in practice
Real designs mesh only the critical core and use star topology at the edge, keeping the resilience where it matters and the cost manageable.
Real-world example
Internet backbone providers run partial meshes between major cities. When a submarine cable is cut, traffic reroutes within seconds over the remaining links, and most users never notice.
Where people get this wrong
Full mesh gets studied as the ideal. It is almost never built, because the link count grows faster than any budget. The real skill is deciding which handful of nodes deserve mesh treatment and which do not.
Common interview questions
How many links does a full mesh of 8 nodes need?
28 — using n(n-1)/2, so 8 × 7 / 2.
Why is full mesh rare in a LAN?
The cabling and port count become impractical and expensive very quickly as devices are added.
What is a partial mesh?
Only the most important nodes are fully interconnected while the rest use simpler links — the standard compromise in WAN design.
What is the biggest advantage of mesh topology?
Redundancy. Multiple independent paths mean a single failure does not interrupt communication.
Inside the Druvexaa simulation
Add nodes one at a time in the simulation and watch the link count climb along the n(n-1)/2 curve — the moment full mesh stops being practical is something you can see rather than calculate.
A mobile call is a chain of radio and network handoffs. Your phone reaches the nearest tower, the operator's core network locates the person you are calling, and a voice path is stitched together between the two.
Fig. 24 — When you make a mobile call
Swipe sideways to see the whole diagram →
Step by step
Register with the network
Your SIM identifies you. The network records which cell you are in so it knows where to find you.
Request the call
Dialling sends a setup request over the control channel to the base station.
The core locates the callee
The operator's core network looks up the destination number's current location, possibly on a different operator's network.
Ring and answer
The destination phone is paged and rings. When it answers, both ends are told which channels to use.
Voice is digitised
Your voice is sampled, compressed by a codec, and sent as data over the radio link — modern calls use VoLTE, which is voice over the data network.
Handover while moving
As you move, the network transfers your call to the next tower mid-conversation. Done well, you never hear it happen.
Real-world example
Talking on a call while riding through Bengaluru traffic means your phone may hand over between a dozen towers. Each handover is negotiated in milliseconds before the old signal is dropped — a dropped call is usually a handover that failed.
Where people get this wrong
Dropped calls are blamed on weak signal. More often they are a handover that did not complete in time, which is why calls drop while moving rather than while standing still in the same weak spot.
Common interview questions
What is a handover?
Transferring an active call from one base station to another as the user moves, without interrupting the conversation.
What does the SIM card actually do?
It securely stores the subscriber identity and cryptographic keys used to authenticate to the operator's network.
What is VoLTE?
Voice over LTE — carrying calls as data packets over the 4G network instead of the older circuit-switched voice path. It connects faster and sounds clearer.
Why do calls drop in lifts and basements?
Radio signals are absorbed by concrete and metal. With too little signal the phone cannot maintain the link or complete a handover.
Inside the Druvexaa simulation
The simulation moves your device between towers along a route so you can watch each handover being negotiated before the old link is released, and see what happens when one fails.
A digital payment is a short, tightly sequenced conversation between your app, the payment network and two banks. The money moves later; what happens in those two seconds is authorisation.
Fig. 25 — UPI and card payments work
Swipe sideways to see the whole diagram →
Step by step
Initiate
You scan a QR code or tap a card. The merchant's app sends the amount and its own identifier.
Authenticate
You approve with a UPI PIN, a card PIN or an OTP. This is the factor that proves it is you and not just your device.
Route the request
UPI requests go through NPCI; card payments go through the acquiring bank to the card network.
Authorise
Your bank checks the balance, the daily limit and fraud rules, then approves or declines in under a second.
Confirm
Both you and the merchant receive confirmation. The transaction is now committed even though no money has physically moved.
Settle
Actual funds transfer between banks in batches later — usually the same day for UPI and over one to three days for cards.
Real-world example
A ₹40 chai paid by UPI QR completes in about two seconds. In that window your PIN was verified, NPCI routed the request, your bank authorised it and the merchant was notified — the money itself settles between the banks hours later.
Where people get this wrong
The two-second confirmation is assumed to be the money moving. It is an authorisation. The funds settle between banks hours later, which is why a refund is slow even though the original payment felt instant.
Common interview questions
What is the difference between authorisation and settlement?
Authorisation is the real-time approval that funds exist and are reserved. Settlement is the later movement of money between banks.
What is two-factor authentication in payments?
Two independent proofs — something you have, such as your registered phone, plus something you know or are, such as a PIN or fingerprint.
Why is a UPI PIN never sent to the merchant?
It is entered inside the banking layer on your own device. The merchant only receives a success or failure response, never your credentials.
What is the role of NPCI in UPI?
It operates the switch that routes requests between banks and maintains the addressing system that maps a UPI ID to an account.
Inside the Druvexaa simulation
The simulation separates the authorisation timeline from the settlement timeline, so the gap between the confirmation on your screen and the money actually moving becomes visible.
Subnetting splits one large IP network into several smaller ones by borrowing bits from the host portion of the address. It is how a single allocated range gets divided between departments, floors or sites.
Fig. 26 — Subnetting
Swipe sideways to see the whole diagram →
Step by step
Start with the mask
A /24 mask means 24 bits identify the network and 8 bits identify hosts, giving 256 addresses in that block.
Borrow host bits
Move the boundary right. Borrowing 2 bits makes it a /26, creating 4 subnets of 64 addresses each.
Count what you get
Subnets equal 2 raised to the borrowed bits. Usable hosts equal 2 raised to the remaining host bits, minus 2.
Find the block size
256 minus the last non-zero mask octet gives the block size. A /26 mask is 255.255.255.192, so 256 − 192 = 64 addresses per subnet.
Write out the ranges
Subnets start at multiples of the block size: .0, .64, .128, .192. The first address in each is the network address, the last is the broadcast.
Use VLSM where sizes differ
Variable Length Subnet Masking lets a point-to-point link take a /30 while a user floor takes a /24, instead of wasting a large block on two addresses.
Real-world example
A college gets 192.168.1.0/24 and needs four separate departments. Splitting it into four /26 subnets gives each department 62 usable addresses and its own broadcast domain, without asking anyone for more address space.
Where people get this wrong
Subnetting is treated as a formula to memorise for exams, so people learn to calculate a /26 and never learn why they would choose one. The real driver is broadcast containment and access control — you subnet to make groups that can be separated and policed, and the arithmetic is just how you express that decision.
Common interview questions
How many usable hosts are in a /27?
30. A /27 leaves 5 host bits, giving 32 addresses, minus the network and broadcast addresses.
What is the block size for a /28?
16. The mask is 255.255.255.240, and 256 − 240 = 16, so subnets start at .0, .16, .32 and so on.
Why can't the first and last address in a subnet be assigned?
The first identifies the network itself and the last is the broadcast address for that subnet. Neither refers to a single host.
What is VLSM and why does it matter?
Variable Length Subnet Masking allows different mask lengths within one network, so a two-address router link can use a /30 instead of consuming a whole /24.
Inside the Druvexaa simulation
The addressing view lets you drag the prefix boundary and watch the subnet count, block size and usable host count recalculate live, with the network and broadcast addresses highlighted in every range so you can see exactly which two you cannot assign.
A port is a 16-bit number that identifies which application a packet belongs to on a machine. A socket is the full combination of IP address and port on both ends, and it is what uniquely identifies a single connection.
Fig. 27 — Ports and Sockets
Swipe sideways to see the whole diagram →
Step by step
The problem ports solve
One IP address, many applications. Without a port number the operating system would not know which program a packet is for.
Well-known ports
0 to 1023 are reserved for standard services — 80 for HTTP, 443 for HTTPS, 22 for SSH, 53 for DNS. These usually require administrator rights to bind.
Registered and ephemeral
1024 to 49151 are registered for specific software. Above that, the operating system hands out temporary ephemeral ports to outgoing connections.
A server listens
A listening socket binds to a port and waits. It is defined by just the local address and port.
A client connects
The client picks a random ephemeral source port. The connection is now identified by four values: source IP, source port, destination IP, destination port.
Why four values matter
That four-tuple is why one browser can hold twenty simultaneous connections to the same server — every one has a different source port.
Real-world example
Open three tabs to the same site and your machine holds three separate connections to the same destination IP and port 443. They stay untangled purely because each one left from a different ephemeral source port.
Where people get this wrong
Ports get described as doors in a wall, which makes people think a closed port is blocked by security. A port is closed simply because nothing is listening on it. Blocking is a firewall decision made separately — and the difference matters, because a connection refused and a connection timed out tell you two completely different things during troubleshooting.
Common interview questions
What is the difference between a port and a socket?
A port is just a number. A socket is the endpoint pair — IP address plus port — and a connection is identified by the sockets at both ends.
How can one server handle thousands of connections on port 443?
Each connection has a different client IP or client source port, so the four-tuple is unique even though the server side is identical.
What is an ephemeral port?
A short-lived port the operating system assigns to an outgoing connection, released when the connection closes.
Name the ports for HTTP, HTTPS, SSH and DNS.
80, 443, 22 and 53. DNS uses 53 over both UDP and TCP.
Inside the Druvexaa simulation
The transport layer view labels every segment with its source and destination port as it crosses the wire, so you can open several connections at once and watch the operating system keep them apart using nothing but the port numbers.
HTTP is the protocol browsers use to request and receive web pages. HTTPS is the same protocol wrapped in TLS encryption, so the contents cannot be read or modified by anyone between you and the server.
Fig. 28 — Difference between HTTP and HTTPS
Swipe sideways to see the whole diagram →
Step by step
A plain HTTP request
The browser sends a readable text request. Anyone on the path — a café router, an ISP — can read and alter it.
TLS starts the conversation
With HTTPS, the browser first sends a ClientHello listing the encryption methods it supports.
The server proves who it is
It replies with its certificate, signed by a Certificate Authority the browser already trusts.
The browser checks the certificate
It verifies the signature chain, the expiry date, and that the name on the certificate matches the site being visited.
Keys are agreed
Both sides derive a shared session key. Modern TLS uses forward secrecy, so recording the traffic today does not help an attacker who steals the server key later.
Normal HTTP resumes, encrypted
Every request and response after this point travels inside the encrypted channel on port 443.
Real-world example
On café Wi-Fi, an HTTPS page means the network owner can see that you visited a site but not which page you read or what you typed. On plain HTTP, they can see and change every word of it.
Where people get this wrong
The padlock is widely read as proof that a site is trustworthy. It only proves the connection is encrypted and the certificate matches the domain. A phishing site can obtain a valid certificate in minutes, so a padlock on a lookalike domain is exactly as secure and exactly as dangerous.
Common interview questions
What does TLS actually provide?
Confidentiality through encryption, integrity so tampering is detected, and authentication of the server through its certificate.
What is a Certificate Authority?
An organisation browsers already trust, which signs certificates to vouch that a public key really belongs to a given domain.
Why is HTTPS on port 443 rather than 80?
It is a separate default so a server can offer both, and so intermediate devices can distinguish encrypted from plain traffic without inspecting it.
What is forward secrecy?
Session keys are derived per connection and never stored, so compromising the server's long-term private key does not decrypt previously recorded sessions.
Inside the Druvexaa simulation
The tunnel view shows the same HTTP request twice — once in plain text where every header and form field is readable on the wire, and once inside TLS where an observer sees only the destination and a block of ciphertext.
Ping tests whether a host is reachable and how long a round trip takes. Traceroute reveals every router along the path by deliberately sending packets that expire one hop further each time.
Fig. 29 — Ping and Traceroute work
Swipe sideways to see the whole diagram →
Step by step
Ping sends an echo request
An ICMP Echo Request goes to the target. A healthy host replies with an Echo Reply.
The round trip is timed
The difference between sending and receiving is the round-trip time, reported in milliseconds.
Loss is counted
Requests with no reply are recorded as lost, which is how ping measures packet loss over a series of attempts.
Traceroute abuses the TTL field
It sends a packet with TTL set to 1. The first router decrements it to zero, discards it, and reports the expiry back — revealing its own address.
Increment and repeat
TTL 2 exposes the second router, TTL 3 the third, and so on until the destination itself answers.
Read the pattern, not the numbers
One slow hop in the middle with normal times after it is a router deprioritising its own replies, not a problem. Delay that rises at a hop and stays high is the real signal.
Real-world example
A site feels slow. Ping shows 240 ms and no loss, so nothing is broken — the distance is simply large. Traceroute confirms it, showing the path leaving the country before reaching the server.
Where people get this wrong
A hop that shows asterisks or a high time is immediately blamed for the problem. Routers treat replies to expired packets as their lowest priority, so a busy core router can look terrible in traceroute while forwarding your actual traffic perfectly. Only a delay that persists across every hop after it is meaningful.
Common interview questions
Which protocol does ping use?
ICMP — an Echo Request out and an Echo Reply back. It sits at Layer 3 and uses no port numbers.
How does traceroute discover intermediate routers?
By sending packets with deliberately low TTL values so each router in turn discards the packet and returns an ICMP Time Exceeded message identifying itself.
Why might a host not respond to ping even though it is up?
Many firewalls and hosts are configured to drop ICMP, so no reply does not prove the host is down.
What does high jitter in ping output indicate?
Variable queuing delay somewhere on the path — usually congestion, and a strong predictor of poor call or game quality.
Inside the Druvexaa simulation
The path view lets you send probes with the TTL you choose and watch the packet die at a specific router, with that router's reply travelling back — so the trick behind traceroute becomes something you watch rather than something you take on faith.
A proxy is a server that makes requests on someone's behalf. A CDN is a global network of caching proxies that serve content from a location near the user instead of from the origin server.
Fig. 30 — Proxies and CDNs
Swipe sideways to see the whole diagram →
Step by step
A forward proxy sits with the client
It makes outbound requests for users, which allows filtering, logging and caching on a company network.
A reverse proxy sits with the server
Users reach it instead of the real server. It can terminate TLS, balance load and hide the origin's address.
A CDN is many reverse proxies
Copies of the same cache are placed in dozens of cities, each one a point of presence.
DNS sends you to the closest one
The CDN answers a lookup with the address of the nearest edge, so the request travels a short distance.
Cache hit or miss
If the edge already holds the file, it answers immediately. If not, it fetches once from the origin, stores it, and serves everyone else locally.
Origin load collapses
A viral page can be requested a million times while the origin server sees only a handful of fetches.
Real-world example
A video hosted in the United States loads instantly in Bengaluru because the CDN placed a copy at an Indian edge node. Your request travelled a few hundred kilometres, not fifteen thousand.
Where people get this wrong
A CDN is assumed to make the website itself faster. It makes the delivery of static files faster. A slow database query on the origin is untouched by any amount of edge caching — which is why sites sometimes add a CDN, see no improvement, and conclude it did not work when they simply cached the wrong layer.
Common interview questions
What is the difference between a forward and a reverse proxy?
A forward proxy acts for the client and the server does not know the real user. A reverse proxy acts for the server and the client does not know the real origin.
How does a CDN reduce latency?
By serving content from a geographically nearer location, which shortens the physical round trip that no bandwidth upgrade can fix.
What is a cache miss?
A request for content the edge does not hold, forcing it to fetch from the origin once before it can serve future requests locally.
Why do CDNs help with traffic spikes?
Edge nodes absorb the vast majority of requests, so a sudden surge never reaches the origin infrastructure.
Inside the Druvexaa simulation
The server switching simulation lets you place edge nodes at different distances and watch request paths shorten as caches warm up, along with a counter showing how quickly origin traffic falls once the edges hold the content.
These topics are written to the same depth. A dedicated Druvexaa simulation is planned for each — until then, every one links to the closest existing simulation and quiz.
Ethernet is the wired standard that almost every local network runs on. It defines the cable, the electrical signalling and the frame format that carries data between devices on the same network.
Fig. 31 — Ethernet
Swipe sideways to see the whole diagram →
Step by step
The frame format
Every Ethernet frame carries a destination MAC, a source MAC, a type field, the payload, and a checksum at the end.
MTU of 1500 bytes
The standard payload limit. Larger data is split by the layer above, which is why TCP segments are sized around it.
The FCS catches corruption
A checksum lets the receiver detect a damaged frame and discard it. Ethernet detects errors but never repairs them.
Cabling categories
Cat5e handles gigabit over 100 m. Cat6 and Cat6a extend that to 10 gigabit over shorter and full runs respectively.
Auto-negotiation
Two connected ports agree on the fastest speed and duplex mode both support. A mismatch here causes the classic slow-but-working link.
Real-world example
Every wall port in an office ends at an Ethernet switch. The 1500-byte limit is why a large file becomes thousands of frames — and why a single bad cable shows up as a rising error counter rather than a total failure.
Where people get this wrong
Cable category is treated as the thing that sets your speed, so people buy Cat6 expecting a faster internet connection. The cable only sets the ceiling of the local link. If your broadband delivers 100 Mbps, Cat5e was never the limitation, and the upgrade changes nothing you can measure.
Common interview questions
What is the standard Ethernet MTU?
1500 bytes of payload. Jumbo frames raise it to around 9000 bytes but require support on every device in the path.
What does the FCS field do?
It carries a checksum so the receiver can detect a corrupted frame and drop it. Ethernet does not retransmit.
What is a duplex mismatch?
One end running full duplex while the other runs half duplex. The link works but throughput collapses and error counters climb.
Inside the Druvexaa simulation
No dedicated Ethernet simulation yet. The ARP simulation is the closest — it opens real Ethernet frames on the wire and lets you read every header field described above.
Packet switching breaks data into independent packets that each find their own way across the network. Circuit switching instead reserves a dedicated path for the whole conversation before any data moves.
Fig. 32 — Packet Switching
Swipe sideways to see the whole diagram →
Step by step
Data is split
The message is divided into packets, each carrying its own destination address.
Each packet routes independently
Routers forward each one using the best path available at that moment, so two packets can travel different routes.
Store and forward
Each router receives a packet fully, checks it, then forwards it. This adds a small delay at every hop.
Reassembly at the end
The destination puts packets back in order using sequence numbers, which is a job for TCP rather than the network.
Statistical multiplexing
Because idle users consume nothing, far more users can share the same link than a reserved-circuit design would allow.
Real-world example
A phone call on the old network held a dedicated circuit open even during silence. A modern call sends packets only when someone speaks, which is why one fibre link now carries thousands of simultaneous conversations.
Where people get this wrong
Packet switching is assumed to be strictly better. It trades guarantees for efficiency — with no reservation, a congested link delays everyone, which is exactly why real-time traffic needs QoS to claw back some of what circuit switching gave for free.
Common interview questions
Why does the internet use packet switching?
It shares capacity efficiently and survives failures, since packets simply route around a broken link instead of losing a reserved circuit.
What is store and forward?
A router fully receives and verifies a packet before forwarding it, which adds latency at each hop but prevents corrupt data spreading.
Can packets arrive out of order?
Yes. Different packets may take different paths, so reordering is handled at the transport layer by sequence numbers.
Inside the Druvexaa simulation
No dedicated simulation yet. The bandwidth and latency simulation demonstrates the consequence of shared capacity, showing delay rising as more traffic competes for the same link.
These are the four ways a packet can be addressed: to one specific device, to every device on the segment, to a subscribed group, or to whichever member of a group is nearest.
Fig. 33 — Unicast, Broadcast, Multicast and Anycast
Swipe sideways to see the whole diagram →
Step by step
Unicast
One sender, one receiver. The overwhelming majority of traffic on any network.
Broadcast
Sent to every device in the broadcast domain. Cheap for the sender, expensive for everyone forced to process it.
Multicast
Delivered only to devices that joined the group. One video stream can reach a thousand subscribers without a thousand copies leaving the source.
Anycast
One address advertised from many locations. Routing delivers each request to the nearest instance, which is how DNS root servers and CDNs scale.
Why VLANs matter here
Broadcast traffic is contained within a VLAN, which is the main reason large flat networks are split up.
Real-world example
Your phone joining Wi-Fi broadcasts a DHCP Discover that every device on the segment receives. Once it has an address, essentially everything it does afterwards is unicast.
Where people get this wrong
Broadcast is treated as harmless because each frame is small. On a large flat network the cost is not bandwidth, it is that every device's CPU must inspect every broadcast. This is why broadcast storms take down networks that still show plenty of spare bandwidth.
Common interview questions
What is the difference between broadcast and multicast?
Broadcast reaches every device on the segment. Multicast reaches only devices that explicitly joined the group.
Why does IPv6 have no broadcast?
Multicast covers the same needs more efficiently, since only interested devices process the traffic.
Where is anycast used?
DNS root servers and CDN edges, where the same address is announced from many sites and routing picks the nearest.
Inside the Druvexaa simulation
No dedicated simulation yet. The ARP and hub simulations both show broadcast behaviour directly — every device receiving a frame it did not ask for, and discarding it.
Routing protocols let routers learn paths from each other automatically instead of being configured by hand. OSPF handles routing inside one organisation; BGP handles routing between the organisations that make up the internet.
Fig. 34 — Routing Protocols (OSPF and BGP)
Swipe sideways to see the whole diagram →
Step by step
Static routing does not scale
Hand-written routes work for a few links, but every change means visiting every router.
Distance vector
Older protocols like RIP share their whole routing table with neighbours and count hops. Simple, slow to converge, limited in size.
Link state
OSPF floods information about link status to every router, so each one builds a full map and runs Dijkstra's algorithm to find shortest paths.
Reconvergence
When a link fails, OSPF routers recalculate and switch to an alternate path within seconds.
Path vector and policy
BGP exchanges the full list of autonomous systems a route passes through. Its decisions follow business policy and contracts rather than pure speed.
Why BGP is fragile
It trusts what it is told. A misconfigured announcement can pull large amounts of internet traffic to the wrong place, which has happened repeatedly.
Real-world example
Inside a campus, OSPF reroutes around a cut fibre in seconds without anyone noticing. Between countries, BGP decides which provider carries your traffic — a decision driven by commercial agreements as much as by distance.
Where people get this wrong
BGP is assumed to pick the fastest route. It picks the route that policy prefers, which is frequently not the shortest or fastest one. Traffic between two Indian cities can transit Singapore purely because of how providers arranged peering, and no amount of local upgrading changes that.
Common interview questions
What is the difference between an IGP and an EGP?
An interior gateway protocol such as OSPF routes within one autonomous system. An exterior protocol such as BGP routes between autonomous systems.
Which algorithm does OSPF use?
Dijkstra's shortest path first, run over a link-state database that every router in the area shares.
Why is BGP convergence slow compared with OSPF?
It exchanges policy-laden path information across many independent organisations, and damping mechanisms deliberately slow reaction to unstable routes.
Inside the Druvexaa simulation
No dedicated simulation yet. The default gateway and router simulations show forwarding decisions and routing table lookups, which is the mechanism these protocols exist to populate.
QoS is the set of techniques that decide which traffic gets preferential treatment when a link is congested. Without it, a large download and a live call compete on equal terms and both suffer.
Fig. 35 — Quality of Service (QoS)
Swipe sideways to see the whole diagram →
Step by step
Classification
Traffic is identified by port, protocol, address or deep inspection — voice, video, bulk transfer, everything else.
Marking
Each packet is tagged, usually with a DSCP value in the IP header, so every downstream device knows its class without re-inspecting.
Queuing
Instead of one queue, the interface keeps several. Voice sits in a low-latency queue that is served before the others.
Shaping and policing
Shaping buffers excess traffic and releases it smoothly. Policing simply drops what exceeds the limit.
It only matters under congestion
On an uncongested link every queue is empty and QoS changes nothing. It is insurance, not a speed boost.
Real-world example
On an office link, a backup job saturating the connection would normally make calls unusable. With QoS the call traffic is served from a priority queue and stays clear, while the backup simply finishes a little later.
Where people get this wrong
QoS is bought as a way to make the network faster. It cannot create capacity — it only decides who suffers when capacity runs out. Applying it to a link that is genuinely undersized just moves the pain around, and the honest fix is more bandwidth.
Common interview questions
What is the difference between shaping and policing?
Shaping buffers excess traffic and sends it later, smoothing the flow. Policing drops or re-marks traffic that exceeds the rate immediately.
What is DSCP?
A field in the IP header used to mark a packet's priority class so every device along the path can queue it consistently.
Does QoS help on an uncongested link?
No. Queues are empty, so every packet is served immediately regardless of its marking.
Inside the Druvexaa simulation
No dedicated simulation yet. The bandwidth and latency simulation lets you saturate a link and watch delay-sensitive traffic degrade, which is exactly the problem QoS is designed to manage.