I thought it might be useful to collect some of the questions I or my friends have been asked over the years. I've had a number of jobs in the computer industry with the side effect that I've been to a lot of interviews. Obviously these are all centered around Linux System Administration since that's my profession.

So to dive right in, here are some questions I remember:

• Name the three packets exchanged in the setup of a TCP connection. Followup: name the three packets exchanged when a client closes a TCP connection.

Answer: SYN, SYN/ACK, SYN Followup: FIN, ACK, FIN, ACK

• Three times are kept for every unix file. What are they?

Answer: atime, ctime, and mtime. The atime is the access time, i.e. the last time the file was read. ctime seems like it should be the creation time, but it isn't. In fact, there is no way to determine when a file was created in Unix. ctime stands for change time, and it is a record of the last time the file's inode was changed. This happens for example when the permissions or ownership on the file are modified.

Finally, the mtime is the time the file was modified, i.e. when the actual file was written to.

• How many computers can you put on a /17 network?

Interviewers love these sorts of questions. I personally hate them, but maybe that's just me. The answer to this particular question is 32766. The quick formula is (2^(32-17))-2, i.e. subtract the cidr # from 32, raise 2 to that power, and subtract 2. Why subtract 2? Because all 0s and all 1s are not valid system addresses. All 1s is the broadcast address. All 0s is technically a valid address, but for historical reasons you can't use it. Thus for any address range you always have to subtract 2 entries to get the number of usable addresses.

A followup question is what is the netmask? Answer: 255.255.128.0. To calculate, observe that in binary a /17 cidr can be written as:

11111111 11111111 10000000 00000000

the first two octets are 255 (all ones). The last is 0 (all zeros). Thus the only one you need to convert to decimal is 10000000. To do this, dust off your binary knowledge:

10000000 = (0x2^0) + (0x2^1) + (0x2^2) + (0X2^3) + (0x2^4) + (0x2^5) + (0x2^6) + (1x2^7)

2^7 is 128, so it's 0+0+0+0+0+0+0+128 = 128. The netmask is therefore 255.255.128.0.

I suspect there's an easier way to do that.

• What's an inode? Followup: what key piece of information about a file is not stored in the inode?

An inode is the on-disk data structure that describes a file and contains key information such as owner and permission. The answer to the followup is the filename - that is stored in the directory. Followup to followup: this also explains the difference between ctime and mtime.

• What's the first startup script executed on a Fedora system?

Answer: /etc/rc.d/rc.sysinit

• Put the following operations in order from slowest to fastest: read cpu register, disk seek, read from main memory, write to pci bus.

Answer: disk seek, write to pci bus, read from main memory, read cpu register

• Compare the output of two processes using diff. Don't use temporary files.

Answer: use NamedPipesInBash, i.e.:

# diff <(process one) <(process two)

(this one is kind of extra credit)

• What does the sticky bit do when applied to a file? A directory?
• Describe RAID levels 0,1,5, and 0+1. What's the difference between 0+1 and 1+0?
• What's the difference between my and local in perl? Give examples of usage of both.
• Write a script that takes an input word and a corpus of text, and finds all anagrams of the input word in the text.

A pretty good way to do this in perl is to read the input line by line. Then break each line into words by word boundary (\b). Alphabetize the letters of the imput word and each word in the line. If they are a match, you've found an anagram.

• What are the three fundamental data types in Perl?

array, hash, scalar

• Define a zombie process. Followup: when and why does init become the parent of a process?

A process becomes a zombie when it's parent exits without calling wait(). If parent dies before child, init (PID 1) becomes parent of such child. This is necessary to reclaim process state after child exits.

• In bash, what variable contains the exit status of the last executed process?

$?