I was expecting non-keyboard input methods, keyboard scan codes, keymaps, input modes, fonts, glyph selection, screen resolution and rendering. Scan codes are mentioned in the next paragraph, but the rest are ignored (OK, they finally mention DOM rendering, but leave out the earlier screen updates). Two seconds later they are discussing ARP... really? What about virtualization, sandboxing, firewalling, link layer selection, use of multiple concurrent link layers for a given network-layer address range, non-ARP link layers, existing transport-layer sessions to the relevant hosts, VPNs, proxies, offline mode, caches and load balancers (possibly multiple layers), non DNS-based name resolution, differences between available IPv4 and IPv6 address classes (mobile IP), layer 2 transparent proxying (eg. proxy ARP/heartbeat), switch ARP caches, etc.

I also think this is an excellent interview question for any internet-related engineering role, as it really gives people a chance to show their degree of comprehension of many layers.

I would recommend examining from different perspectives: network activity or options at each layer (wireshark), browser activity (firebug, debugger, or read the code), OS activity (debugger, or read the code), program activity (debugger, or read the code, or learn various system monitoring tools like filesystem monitors, kernel or library-based tracers, etc), virtualization systems (their hardware and network emulation), network systems (proxies, load balancers and caches of all configurations) security systems of all kinds. You are right that there is probably no holistic resource, because the question is sort of ridiculously specific.

> Would love to see Knuth's Challenge setup in a repo for collaboration.

Go for it!