Essential Linux Ops: Top Interview Questions, Commands, and RAID/TCP‑IP Insights

21. Analyze IP access: find the top ten IP addresses by page visits from nginx logs.

cat access.log | awk '{print $1}' | uniq -c | sort -rn | head -10

22. Capture traffic to host 192.168.1.1 on TCP port 80 and save the output to tcpdump.log.

tcpdump 'host 192.168.1.1 and port 80' > tcpdump.log

23. Forward requests arriving at the local port 80 to port 8080 on the host with IP 192.168.2.1.

iptables -A PREROUTING -d 192.168.2.1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.2.1:8080

RAID 0 : Striping (bandwidth volume) splits data across multiple disks for parallel read/write, delivering high throughput but no redundancy; a single disk failure destroys all data.

RAID 1 : Mirroring creates exact copies on paired disks, providing data redundancy and improved read performance; usable capacity is half of total, and the cost per usable gigabyte is highest among RAID levels.

RAID 5 : Requires at least three disks; distributed parity allows one disk to fail without data loss, offering both redundancy and enhanced read/write performance.

Operations engineers bear critical responsibility for delivering the highest, fastest, most stable, and most secure services; even a minor mistake can cause major losses, so the role demands rigor and innovative thinking.

26. Real‑time capture and display of current system traffic on TCP port 80. tcpdump -nn tcp port 80 27. Step‑by‑step troubleshooting when a server fails to boot includes checking power, hardware components, BIOS settings, and system logs, then using diagnostic tools to isolate the fault.

28. Linux virus mitigation: the simplest effective method is reinstalling the system; alternatively, locate malicious files with top, ps aux, and delete them, clean startup scripts, and if the infection persists, back up data and reinstall.

29. Persistent virus files that reappear after deletion are usually regenerated by a parent process; identify the parent using lsof, netstat, or ps, terminate it, and remove the malicious executable.

TCP/IP Seven‑Layer Model

Application Layer : Interface for network services and end users; protocols include HTTP, FTP, TFTP, SMTP, SNMP, DNS, TELNET, HTTPS, POP3, DHCP.

Presentation Layer : Handles data representation, security, and compression (merged into the Application layer in the five‑layer model); formats include JPEG, ASCII, DECOIC, encryption schemes.

Session Layer : Manages establishment, maintenance, and termination of sessions; corresponds to host processes communicating between local and remote hosts.

Transport Layer : Defines transport protocols and ports, flow control, and error checking; protocols are TCP and UDP.

Network Layer : Performs logical addressing and routing between networks; protocols include ICMP, IGMP, IP (IPv4/IPv6), ARP, RARP.

Data Link Layer : Establishes logical connections, hardware address addressing, and error detection; frames are built from bits to bytes using MAC addresses.

Physical Layer : Provides the physical media and signaling for data transmission; defines mechanical, electronic, and functional characteristics of the transmission medium.