I thought it might be useful to collect some of the questions I or my friends have been asked over the years. I've had a number of jobs in the computer industry with the side effect that I've been to a lot of interviews. Obviously these are all centered around Linux System Administration since that's my profession.

So to dive right in, here are some questions I remember:

Answer: SYN, SYN/ACK, SYN Followup: FIN, ACK, FIN, ACK

Answer: atime, ctime, and mtime. The atime is the access time, i.e. the last time the file was read. ctime seems like it should be the creation time, but it isn't. In fact, there is no way to determine when a file was created in Unix. ctime stands for change time, and it is a record of the last time the file's inode was changed. This happens for example when the permissions or ownership on the file are modified.

Finally, the mtime is the time the file was modified, i.e. when the actual file was written to.

Interviewers love these sorts of questions. I personally hate them, but maybe that's just me. The answer to this particular question is 32766. The quick formula is (2^(32-17))-2, i.e. subtract the cidr # from 32, raise 2 to that power, and subtract 2. Why subtract 2? Because all 0s and all 1s are not valid system addresses. All 1s is the broadcast address. All 0s is technically a valid address, but for historical reasons you can't use it. Thus for any address range you always have to subtract 2 entries to get the number of usable addresses.

A followup question is what is the netmask? Answer: 255.255.128.0. To calculate, observe that in binary a /17 cidr can be written as:

11111111 11111111 10000000 00000000

the first two octets are 255 (all ones). The last is 0 (all zeros). Thus the only one you need to convert to decimal is 10000000. To do this, dust off your binary knowledge:

10000000 = (0x2^0) + (0x2^1) + (0x2^2) + (0X2^3) + (0x2^4) + (0x2^5) + (0x2^6) + (1x2^7)

2^7 is 128, so it's 0+0+0+0+0+0+0+128 = 128. The netmask is therefore 255.255.128.0.

I suspect there's an easier way to do that.

An inode is the on-disk data structure that describes a file and contains key information such as owner and permission. The answer to the followup is the filename - that is stored in the directory. Followup to followup: this also explains the difference between ctime and mtime.

Answer: /etc/rc.d/rc.sysinit

Answer: disk seek, write to pci bus, read from main memory, read cpu register

Answer: use NamedPipesInBash, i.e.:

# diff <(process one) <(process two)

(this one is kind of extra credit)

A pretty good way to do this in perl is to read the input line by line. Then break each line into words by word boundary (\b). Alphabetize the letters of the imput word and each word in the line. If they are a match, you've found an anagram.

array, hash, scalar

A process becomes a zombie when it's parent exits without calling wait(). If parent dies before child, init (PID 1) becomes parent of such child. This is necessary to reclaim process state after child exits.

$?