Layer 3 · Go deeper · 9 min
Go deeper
Size it, build it, then make the calls an interviewer will push you on.
Back of the envelope
Size it up
Tap through each step of the arithmetic.
Your GKE cluster has a /21 pod range. How many nodes can it reach?
600 pods each pool 100 connections to one partner. Does one NAT IP cope?
Build-up · 6 steps
Route one packet by longest prefix
A packet for 10.20.9.5 meets a router with five routes. Four of them match; watch how it picks one.
Step 1 of 6
A packet arrives
Nobody on the way needs to know who the packet is for. The router reads only the destination and looks it up in a table of prefixes and next hops.
4 interview moments
You’re the candidate
The interviewer pushes on the hard parts. Pick an approach and see how it holds up.
Deep dive 1 of 4
Interviewer
“Your login API needs abuse limits, and the interviewer says “just limit per IP.” What do you propose?”
Your move. Pick an approach:
Deep dive 2 of 4
Interviewer
“At peak, pods time out calling one payment gateway. CPU is idle and the partner is healthy. What do you change?”
600 pods each hold 100 pooled connections through an AWS NAT gateway with one public IP.
Your move. Pick an approach:
Deep dive 3 of 4
Interviewer
“Every team is creating its own AWS VPC. Which address ranges should they use?”
Your move. Pick an approach:
Deep dive 4 of 4
Interviewer
“A bank accepts calls only from allowlisted IPs, but your pods change address on every deploy. What do you do?”
Your move. Pick an approach:
Build-up · 5 steps
Follow three users through carrier NAT
Two phones and a home router share one carrier-grade NAT. Watch what the NAT records, and what your load balancer is left with.
Step 1 of 5
A phone dials your API
IPv4 ran out, so the carrier gives Phone A a 100.64.x.x address the internet can’t route. It connects from port 51000 to your API.