DNS UDP 53
DNS is the internet's phone book. You know a name (google.com) but computers need an IP address (142.250.x.x) to connect. DNS translates names → numbers. It's hierarchical: root → TLD → authoritative, like country → city → street.
Query: google.com type A class IN
Answer: google.com 300s A 142.250.80.46
TCP 3-Way Handshake Layer 4
Before any data flows, both sides must agree to talk. TCP uses a 3-step dance: SYN (I want to connect), SYN-ACK (OK, I'm ready), ACK (great, let's go). This ensures both sides are alive and agree on sequence numbers.
→ SYN seq=1000
← SYN-ACK seq=5000 ack=1001
→ ACK ack=5001
TLS 1.3 HTTPS
TLS encrypts everything so nobody on the network can read your traffic. TLS 1.3 does it in 1 round trip (TLS 1.2 needed 2). The browser sends the domain name in the SNI field so the server knows which certificate to use — since many sites share one IP.
ClientHello + SNI: google.com
ServerHello + Certificate
{Finished} — encrypted from here!
HTTP vs HTTPS
HTTP is the language browsers and servers use to ask for and deliver web pages. HTTPS = HTTP + TLS encryption. Without TLS, anyone on your WiFi can read your exact request and response. With TLS, they see only encrypted bytes.
GET / HTTP/2
Host: www.google.com
Accept: text/html
Cookie: ...
HTTP/2 & Multiplexing What Google Uses
HTTP/1.1 sent one request at a time per connection. HTTP/2 sends dozens of requests simultaneously over one connection — called multiplexing. This is why modern pages (with 50+ resources) load so much faster than they did in 2005.
Stream 1: GET / → 200 HTML
Stream 3: GET /style.css → 200
Stream 5: GET /logo.png → 200
(all happening at once!)
CDN — Content Delivery Network
Google doesn't serve your request from California. They have hundreds of edge servers worldwide. The CDN picks the nearest one (maybe 10ms away). Without a CDN, a user in India might wait 200ms just for the TCP handshake to reach a US server.
IP Routing
Your packet doesn't jump directly to Google. It hops through 10-20 routers along the way, each reading the destination IP and deciding the next hop — like a postal relay system where each post office reads the address and forwards it onward.
traceroute google.com
1. 192.168.1.1 (home router)
2. 10.x.x.x (ISP)
3. 72.x.x.x (upstream)
...
14. 142.250.80.46 (Google)
What the Browser Actually Renders
The browser receives raw HTML text, parses it into a DOM tree, fetches linked CSS/JS/images, applies styles to build the Render Tree, lays out element positions, then paints pixels to the screen. This whole process is called the Critical Rendering Path.
HTML → DOM
CSS → CSSOM
DOM + CSSOM → Render Tree
Layout → Paint → Composite
DNS Caching — Why It's Fast Next Time
DNS answers come with a TTL (Time To Live) — typically 300s to 86400s. Your browser, OS, and ISP all cache the answer. Second visit? You skip all those DNS hops and go straight to TCP. Google's TTL is usually 300 seconds (5 minutes).
google.com TTL=300 A 142.250.80.46
;; Cached — no DNS lookup needed!