Networks

Networking is the subject where a broad answer sounds confident and says nothing. Interviewers ask it because every backend bug becomes a network bug: a slow query, a dropped webhook, an expired certificate. In your projects it is the TLS terminator and health checks in Shiplane, and the retried webhooks in Ledgerline.

SDE-1 scope vs SDE-2 scopeCopy Anchor Link

RoadmapCopy Anchor Link

Stage 1: the basics (week 3, Nov 2 to 8)Copy Anchor Link

Start with the week 3 drill questions. Learn layers, TCP versus UDP, the handshake, then DNS. Draw each on paper before you answer out loud.

Stage 2: interview core (week 3, then weeks 20 to 25)Copy Anchor Link

Add TLS, the HTTP versions, load balancers, and retries with idempotency. Record each answer at 60 to 90 seconds. Re-answer in mock season and fix the vague parts.

Stage 3: SDE-2 depth (after the offer)Copy Anchor Link

Read congestion control properly, then QUIC, anycast and service mesh. This is on-the-job depth, not offer-winning depth.

Core topics, in orderCopy Anchor Link

The request path, onceCopy Anchor Link

Every "what happens when you type a URL" answer is this diagram with one node expanded.

Loading diagram…

Say the path in order, then go deep on the node the interviewer picks.

TCP versus UDPCopy Anchor Link

TCP gives you a connection, ordered bytes, retransmission, flow control and congestion control. UDP gives you datagrams with no ordering and no retry. TCP pays with a handshake, per-packet acknowledgements, and head-of-line blocking: one lost packet stalls everything behind it.

Use TCP where every byte must arrive: HTTP, database connections, payments. Use UDP where a late packet is worse than a lost one: live video, games, voice, and QUIC under HTTP/3. DNS uses UDP for small queries and falls back to TCP for large answers.

After the handshakeCopy Anchor Link

The three-way handshake is SYN, SYN-ACK, ACK. The client sends a random sequence number, the server acknowledges it and sends its own, and the client acknowledges that. After one round trip, both sides can send data.

Flow control protects the receiver. The receiver advertises a window, and the sender stops when it is full. Congestion control protects the network. The sender grows a congestion window while packets get through and cuts it when they do not. Slow start doubles it each round trip, then growth becomes linear.

The sentence that works: "Flow control is the receiver saying how much it can take; congestion control is the sender guessing how much the network can take." Leave CUBIC and BBR for later.

TLS in one answerCopy Anchor Link

TLS gives you confidentiality, integrity, and proof that the server owns the certificate for that hostname. It does not prove the server is honest, and it does not hide IP addresses or, without newer extensions, the hostname.

In TLS 1.3 the client sends a ClientHello with a key share. The server replies with its key share, its certificate chain, and a Finished message. The client verifies the chain, checks the hostname and expiry, and sends its own Finished. That is one round trip before data, down from two in TLS 1.2.

A certificate is valid when a trusted root signs the chain, the subject alternative name matches the host, and the dates are current. Browsers ship the root store, which is why a self-signed certificate fails.

In Shiplane, Caddy gets and renews that certificate. The health check and alert are your answer to a failed renewal.

HTTP/1.1, HTTP/2 and HTTP/3Copy Anchor Link

HTTP/1.1 is text-based and one request at a time per connection, so browsers open several connections and still hit head-of-line blocking.

HTTP/2 is binary and multiplexed. Many streams share one TCP connection, and header compression cuts repeated headers. It fixes application-level blocking, but a lost TCP packet still stalls every stream.

HTTP/3 runs over QUIC on UDP. Streams are independent at the transport layer, so one lost packet stalls only its own stream. QUIC also folds the TLS 1.3 handshake into connection setup.

Know the methods. GET and HEAD are safe and idempotent. PUT and DELETE are idempotent but not safe. POST is neither, which is why Ledgerline puts an idempotency key on POST /transfers.

For status codes, learn 200, 201, 204, 301, 304, 400, 401, 403, 404, 409, 422, 429, 500, 502, 503, 504. The pair interviewers probe is 502 versus 504. A 502 means an upstream sent an invalid response. A 504 means the gateway waited and the upstream did not answer in time.

DNS, proxies and load balancersCopy Anchor Link

DNS resolves a name through a recursive resolver, which asks a root server, then a TLD server, then the authoritative server. The answer is cached for its TTL. A is IPv4, CNAME is an alias, MX is mail, TXT holds verification strings.

A forward proxy makes requests for clients. A reverse proxy sits in front of servers, terminates TLS, routes by host or path, and hides the backend. Caddy in Shiplane is one, and so is the load balancer in front of three app instances.

An L4 load balancer routes by IP and port. It is fast and does not read the request. An L7 load balancer reads HTTP, so it can route /api to one service, retry an idempotent request, or pin a session. Most answers want L7 for HTTP and L4 for raw TCP.

CDNs are reverse proxies at the edge. They cache responses near the user, terminate TLS there, and cut origin load. The cache key and TTL decide whether you get a hit, and a purge is how you fix a bad deploy.

Timeouts, retries and idempotencyCopy Anchor Link

Set four timeouts on every client call: connect, TLS, response header, and total. A missing timeout is how one slow dependency becomes an outage, because connections pile up waiting.

Retry only when the operation is idempotent. GET, PUT and DELETE are idempotent by HTTP semantics. POST is not, so either do not retry it, or send an idempotency key and store the result against that key.

Back off exponentially and add jitter. Ledgerline's webhook worker waits 1 s, 4 s, 16 s, then 64 s, with jitter, so workers do not retry in lockstep. Cap the attempts, and do not retry a 400 or 401. A 429 or 503 is worth retrying after the delay the server gives you.

Retries multiply. Three layers retrying three times turn one click into 27 requests. The fix is a retry budget or a single retry layer.

WebSockets and gRPCCopy Anchor Link

A WebSocket starts as an HTTP request with an Upgrade: websocket header. Once the server agrees, the same TCP connection carries frames both ways. Proxies must allow the upgrade and an idle timeout, or the connection dies quietly.

gRPC uses HTTP/2 and protobuf. You define a service in a .proto file and generate client and server code, with streaming and deadlines. It is common between internal services.

ResourcesCopy Anchor Link

LearnCopy Anchor Link

• HTTP request methods: the safe and idempotent table to redraw.
• HTTP response status codes: read the 4xx and 5xx pages only.
• Building blocks of TCP: handshake, flow and congestion in one chapter.
• What is DNS?: the resolver chain without RFC language.

PracticeCopy Anchor Link

• HTTP/2: draw one connection with three multiplexed streams.
• What happens in a TLS handshake?: narrate the 1.3 exchange in 90 seconds.
• What is HTTP/3?: answer why QUIC moved to UDP.
• What is load balancing?: algorithms, health checks, L4 versus L7.

Long-formCopy Anchor Link

• Introduction to gRPC: when a job description names gRPC.
• What is a CDN?: the edge cache model behind production reads.

Questions to answer out loudCopy Anchor Link

SDE-1:

1. TCP versus UDP, with one production case each.
2. Draw the three-way handshake and say what each packet carries.
3. What does TLS 1.3 exchange, and what does it not prove?
4. Walk me through what happens when you type a URL.
5. Which methods are idempotent, and why does it matter for retries?
6. When do you return 401, 403, 409, 422, 502 and 504?
7. What does a load balancer do, and when L7 over L4?
8. Why does a retry need backoff and jitter?

SDE-2:

9. How do slow start and congestion avoidance set throughput?
10. How does QUIC avoid the blocking HTTP/2 still has?
11. How does anycast route a user to a nearby edge?
12. What does a service mesh sidecar do that a shared proxy cannot?

How this shows up in your projectsCopy Anchor Link

• Shiplane runs Caddy as the TLS terminator and reverse proxy. Explain the chain, the renewal, and the health check that gates blue/green.
• The health gate is three consecutive 200s on /healthz. That is L7, not an L4 port check.
• Ledgerline sends POST /transfers with an idempotency key, so a retry cannot move money twice. Its webhook worker retries with backoff and jitter, HMAC-signs each payload, and survives a fake PSP that drops and duplicates callbacks.

Common mistakesCopy Anchor Link