PIM-SM Explained: RP, Shared Tree, Source Registration and SPT Switchover

PIM-SM interview questions become easier when you separate receiver joins, source registration and the later forwarding-path change. This guide walks through one fictional IPv4 multicast example; it is not a captured production incident or an executed router lab.

Direct answer: PIM Sparse Mode builds receiver-driven multicast trees. In any-source multicast, the rendezvous point (RP) connects source discovery with a shared tree; receivers can later use a source-specific shortest-path tree (SPT).^[1]

X Follow @ipexptobe

How Does a Layer 3 Switch Decide Between Switching and Routing?

A Layer 3 switch can bridge one frame and route the next. The interview question is not simply whether the destination IP is in another subnet: it is how the frame reaches the switch's routing function in the first place.

Short answer: On a Layer 2 switchport, ordinary unicast traffic is bridged within its VLAN using the destination MAC address; a frame addressed to the switch's gateway/SVI MAC can enter Layer 3 processing.[1] Routing then uses the destination IP address to select the onward path and builds a new Ethernet frame for the outgoing link.[1][3]

X Follow @ipexptobe

What Happens When a PC Boots on a Switched Network? DHCP, ARP and DNS Explained

Short answer: On a typical wired IPv4 network, a PC needs a working Ethernet link and an authorized, forwarding switch port; it then obtains or reuses its IP configuration. With a fresh DHCP lease, the familiar exchange is Discover, Offer, Request and Acknowledge.[1]

To send ordinary IPv4 traffic, the host selects a local destination or next-hop router and resolves the required Ethernet address with ARP if necessary.[2][3] DNS is used when an application needs a name resolved, not as an unconditional final step of every boot.[4]

X Follow @ipexptobe

Why Is Traffic Through a Firewall Slow? TCP Troubleshooting and Interview Answer

A connection can establish successfully and still deliver a painfully slow file transfer. The useful interview question is not simply “Can the firewall pass TCP?” but “Where is this particular transaction losing time?”

Short answer: First separate slow connection setup, slow application response and slow bulk transfer. Then reproduce one flow and compare simultaneous captures on both sides of the firewall, together with interface and policy-counter changes; Cisco recommends this method to distinguish loss or delay before, inside and after an ASA.[1] Investigate path MTU and TCP receive-window limits as well as the firewall itself.[2][3]

X Follow @ipexptobe

TCP 3-Way Handshake Explained: TCP Flags and Firewall Troubleshooting

TCP connections that fail through a firewall are easier to troubleshoot when you can explain exactly which handshake packet is missing. This guide answers one interview question: how does the TCP three-way handshake work, and what do its flags tell you during troubleshooting?

Short answer: In a normal client-initiated connection, the client sends SYN, the server replies SYN-ACK, and the client acknowledges with ACK; the exchange synchronizes the two independent sequence-number spaces and helps prevent old duplicate connection attempts from creating false connections.[1]

X Follow @ipexptobe

uRPF Strict vs Loose Mode Explained: Asymmetric Routing and Interview Answer

An interview question asks: What is uRPF, and how do strict and loose mode differ? The useful answer explains both the source-address lookup and the legitimate traffic that the wrong setting can drop.

Short answer: Unicast Reverse Path Forwarding is a source-address validation mechanism. Strict uRPF checks whether the packet arrived on an interface that the reverse-path lookup would use to reach its source; loose uRPF checks whether an acceptable route to that source exists, without requiring the incoming interface to match.[1]

X Follow @ipexptobe

DHCP Snooping vs DAI vs IP Source Guard: Differences and Interview Answer

DHCP snooping, Dynamic ARP Inspection and IP Source Guard answer three different access-layer security questions: which DHCP replies should be accepted, which ARP mappings are valid, and which source IP addresses a host may use.[2][3][1]

Short answer:

• DHCP snooping filters DHCP messages and builds a binding database.[2]
• Dynamic ARP Inspection (DAI) validates incoming ARP claims on untrusted ports.[3]
• IP Source Guard (IPSG) restricts incoming IP traffic using permitted source bindings.[1]

X Follow @ipexptobe

ACL Basics Explained: Standard vs Extended, Implicit Deny and Examples

An ACL interview question often starts with “standard or extended?” and ends with a packet that unexpectedly disappears. The useful answer connects match fields, rule order, interface direction and the traffic that was never explicitly permitted.

Short answer: A classic IPv4 interface access control list is an ordered packet filter: the first matching entry decides permit or deny, and packets that match no entry are denied implicitly.[1] A standard IPv4 ACL matches the source address; an extended ACL can also match destination address, protocol and TCP/UDP ports.[1]

X Follow @ipexptobe

Zone-Based Firewall Explained: Class-Map, Policy-Map and Service-Policy

A Cisco zone-based firewall interview question often starts with three commands: class-map, policy-map and service-policy. The short answer is: a class-map selects traffic, a policy-map assigns an action, and a service-policy attaches that policy to a directional zone-pair.[1]

This guide follows one client connection through that hierarchy and shows why defining a policy is not the same as activating it.

X Follow @ipexptobe

Stateful vs Stateless Firewall Explained: Packet Flow and Interview Answer

A firewall interview often turns on one follow-up question: if an outbound request is allowed, what permits the reply? The answer separates a packet rule from connection tracking.

Short answer: A stateless firewall evaluates packets without remembering the flow; a stateful firewall maintains a connection table and uses that context when evaluating subsequent packets.[3] With a stateful policy, valid replies to an allowed connection can pass without a separate rule permitting a new connection in the reverse direction; a stateless filter needs rules that permit both directions.[1][2]

X Follow @ipexptobe

GRE Tunnel Basics Explained: Source, Destination and Tunnel Interface

Short answer: A basic point-to-point GRE tunnel needs a logical tunnel interface, a local tunnel source and a remote tunnel destination; the destination must already be reachable through the transport network.[2]

The tunnel-interface IP address belongs to the logical link, while the source and destination identify the outer transport endpoints.[2] GRE encapsulates packets; it does not itself provide encryption.[1][2]

The interview question is simple: “What are the three main elements of a GRE tunnel, and how does a packet cross it?” The useful answer separates the underlay, which delivers the encapsulated packet, from the overlay, which carries the original traffic.

X Follow @ipexptobe

IPsec Phase 1 vs Phase 2 Explained: SAs, Crypto Maps and IKEv2

Short answer: In IKEv1, Phase 1 authenticates the VPN peers and establishes the IKE/ISAKMP security association that protects their negotiation; Phase 2 uses that protected channel to negotiate IPsec security associations for data traffic.[1] An established Phase 1 is therefore not proof that your application traffic has a working IPsec SA.

This is the distinction behind the interview question, “What is the difference between IPsec Phase 1 and Phase 2?” The terminology belongs to IKEv1: IKEv2 uses IKE_SA_INIT, IKE_AUTH and CREATE_CHILD_SA exchanges rather than the same two-phase process.[2] IKEv1 is deprecated; learn its terminology for interviews and legacy troubleshooting, not as a recommendation for a new deployment.[3]

X Follow @ipexptobe

NAT vs PAT vs Static NAT vs DNAT Explained with Packet Flow

What is the difference between NAT, PAT, static NAT and DNAT? They describe different aspects of translation, not four mutually exclusive features: NAT is the umbrella, PAT includes transport-port mapping, static NAT fixes an address mapping, and DNAT changes a packet's destination.[1][2][3]

Short answer: Basic NAT translates IP addresses; PAT (called NAPT in RFC 3022) lets multiple internal endpoints share an external address using transport identifiers.[1] Static one-to-one NAT describes how the address mapping is assigned, while SNAT and DNAT describe whether the source or destination is rewritten.[2][3]

X Follow @ipexptobe

Administrative Distance vs Metric vs Longest Prefix Match Explained

Does a router choose the lowest administrative distance, the lowest metric, or the longest prefix? The answer depends on whether you mean building the routing table or forwarding a packet.[1]

Short answer: A routing protocol selects its candidates using its own path-selection rules; administrative distance (AD) selects between competing route sources for the same prefix and prefix length; longest prefix match selects the most specific installed route when forwarding a packet.[1] Do not treat these as three numbers compared together for every packet.[1]

X Follow @ipexptobe

Route Redistribution Risks Between OSPF, EIGRP and BGP: Loops, Tags and Metrics

Route redistribution can make two routing domains reachable while quietly creating a path for routes to return to their origin. The interview question is: what can go wrong when redistributing OSPF, EIGRP and BGP, and how do you prevent it?

Short answer: the main risks are route feedback, unexpected path selection, incompatible metrics and unwanted prefix propagation; Cisco documents filtering and route-tag policies as ways to control these risks.[2] My recommended starting point is a narrow prefix allowlist, explicit target-protocol metrics, origin tagging with return-path rejection, and failure testing at every redistribution boundary.

X Follow @ipexptobe

EIGRP Metric and K-Values Explained: Formula, Examples and Troubleshooting

EIGRP metric questions usually test three things: which inputs matter by default, how bandwidth and delay combine, and why mismatched K-values prevent neighbors from forming.

Short answer: with default K-values, EIGRP uses minimum path bandwidth and cumulative delay; for classic metrics, the calculation is 256 × (10^7 / minimum bandwidth in kbps + total delay in tens of microseconds).[1] K1 and K3 default to 1; K2, K4 and K5 default to 0, so load and reliability do not contribute to the default calculation.[1]

X Follow @ipexptobe

EIGRP Stuck in Active Explained: SIA Troubleshooting and Prevention

EIGRP Stuck in Active (SIA) means that a route's distributed computation has not received a required Reply within the permitted time; Cisco implementations can reset the unresponsive neighbor and remove routes learned through it.[1] For an interview, distinguish normal Active route computation from Stuck in Active, then explain how you would trace the missing reply and reduce query scope.[1][2]

X Follow @ipexptobe