Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What does ARP do?

   1. AAssigns IP addresses
   2. BFinds the MAC address that belongs to an IP on the local network
   3. CRoutes between networks
   4. DEncrypts frames
   Show answer

   B. Before sending to 10.0.0.20 on the same subnet, a host asks 'who has 10.0.0.20?' and caches the MAC in its neighbour table.

   From lesson 01 · Ethernet, ARP & MTU

2. Q2. Pods on different nodes can ping each other, but large HTTP responses hang. What's a likely cause?

   1. ADNS
   2. BMTU mismatch: overlay encapsulation adds bytes, big packets exceed the path MTU, and the 'too big' signal is lost
   3. CRBAC
   4. DCPU limits
   Show answer

   B. Pings are small. Full-size packets plus VXLAN/IPIP headers exceed 1500 bytes; if ICMP 'fragmentation needed' is blocked, they vanish silently.

   From lesson 01 · Ethernet, ARP & MTU

3. Q3. Why is ping -M do -s 1472 a useful test on a 1500-MTU network?

   1. AIt floods the network
   2. B1472 bytes + 8 ICMP + 20 IP = 1500: the largest packet that fits, with fragmentation forbidden
   3. CIt tests DNS
   4. DIt measures bandwidth
   Show answer

   B. If that fails but smaller sizes work, something along the path has a smaller MTU.

   From lesson 01 · Ethernet, ARP & MTU

4. Q4. Two routes match a destination: 10.0.0.0/8 and 10.20.0.0/16. Which one is used for 10.20.5.9?

   1. AThe first one listed
   2. B10.20.0.0/16: the most specific (longest prefix) wins
   3. CBoth, load balanced
   4. DNeither
   Show answer

   B. Linux (like all routers) uses longest prefix match. Metrics only break ties between equally specific routes.

   From lesson 02 · IP routing, NAT & conntrack

5. Q5. What does DNAT do in a Kubernetes Service?

   1. AEncrypts packets
   2. BRewrites the destination from the Service's ClusterIP:port to a chosen pod IP:port
   3. CChanges the source IP
   4. DBlocks traffic
   Show answer

   B. kube-proxy (iptables/IPVS mode) installs DNAT rules; conntrack remembers the choice so replies are rewritten back.

   From lesson 02 · IP routing, NAT & conntrack

6. Q6. Under heavy load, a node logs 'nf_conntrack: table full, dropping packet'. Effect?

   1. ANothing
   2. BNew connections through that node are dropped until entries expire or the limit is raised
   3. CThe node reboots
   4. DDNS is disabled
   Show answer

   B. Every NATed or tracked connection needs a conntrack entry. Size nf_conntrack_max for the workload and monitor usage.

   From lesson 02 · IP routing, NAT & conntrack

7. Q7. Thousands of connections sit in CLOSE_WAIT on your server. What does it usually mean?

   1. AThe network is slow
   2. BThe remote side closed, but your application hasn't closed its end: often a connection leak in the app
   3. CNormal behaviour
   4. DThe firewall is blocking
   Show answer

   B. CLOSE_WAIT = 'peer said goodbye, waiting for the local app to close()'. Growing numbers point at the application.

   From lesson 03 · TCP: state, flags & congestion

8. Q8. What does an RST (reset) right after a SYN usually indicate?

   1. APacket loss
   2. BNothing is listening on that port (or a firewall actively rejects)
   3. CTLS failure
   4. DDNS failure
   Show answer

   B. The host is reachable but refuses the connection. That's 'Connection refused' in applications.

   From lesson 03 · TCP: state, flags & congestion

9. Q9. Why does TIME_WAIT exist?

   1. AIt's a bug
   2. BSo delayed packets from an old connection aren't mistaken for a new one using the same ports, and the final ACK can be resent
   3. CTo slow down attackers
   4. DTo save memory
   Show answer

   B. The side that closes first keeps the connection in TIME_WAIT briefly. It's normal; huge numbers point at many short-lived connections (use keep-alive or pooling).

   From lesson 03 · TCP: state, flags & congestion

10. Q10. What is a veth pair?

    1. ATwo physical NICs
    2. BA virtual Ethernet cable: packets sent into one end come out of the other
    3. CA VLAN
    4. DA firewall rule
    Show answer

    B. One end lives in the pod's network namespace (as eth0), the other on the host, connected to a bridge or routed by the CNI.

    From lesson 04 · Your host's network model

11. Q11. What does a pod with hostNetwork: true get?

    1. AIts own IP
    2. BThe node's network namespace: the node's IPs and ports, with no isolation
    3. CFaster DNS
    4. DA second NIC
    Show answer

    B. Used by some system components (CNI agents, node exporters). It removes network isolation, so avoid it for apps.

    From lesson 04 · Your host's network model

12. Q12. Which component creates the veth pair and assigns the pod IP when a pod starts?

    1. AThe scheduler
    2. BThe CNI plugin, called by the container runtime
    3. CCoreDNS
    4. DThe API server
    Show answer

    B. The kubelet asks the runtime to create the pod sandbox; the runtime calls the CNI plugin (configured in /etc/cni/net.d) to wire up networking.

    From lesson 04 · Your host's network model