What happens, end to end, when you type a website address into a browser and press Enter?
Show the answer
Say this first
The browser parses the URL and checks its caches. It resolves the name through DNS, which first needs the host to reach its resolver: if the resolver is off subnet, the host ARPs for its default gateway MAC. With the server IP in hand, it opens a TCP connection to port 443 (three-way handshake), runs a TLS handshake and checks the certificate, then sends an HTTP GET. Along the way switches forward frames by MAC, routers forward packets by longest prefix match and rewrite layer 2 headers, and the edge usually NATs the private source.
Go deeper
1. Before any packet leaves
The browser parses https://www.example.com/, checks HSTS and its own caches. The OS checks its DNS cache
and the hosts file.
2. Getting off the local network
The host compares the resolver's IP with its own address and mask. If the resolver is on another subnet, the
frame goes to the default gateway. If the gateway MAC is not in the ARP cache, the host broadcasts an ARP
request (destination ff:ff:ff:ff:ff:ff) and the gateway replies with its MAC by unicast.
3. DNS
The host sends a query, usually UDP port 53, to its recursive resolver. On a cache miss the resolver walks
the hierarchy: a root server, the .com TLD servers, then the authoritative servers for example.com. It
returns A and AAAA records with TTLs, and both the resolver and the host cache them.
4. TCP
SYN, SYN-ACK, ACK to port 443 from an ephemeral source port. Each side announces its MSS and window options. With HTTP/3 the browser uses QUIC over UDP 443 instead, which merges transport and TLS setup.
5. TLS 1.3
ClientHello with SNI (the server name), supported ciphers and a key share. The server answers with ServerHello, its certificate chain and Finished. The browser validates the chain up to a trusted root CA and checks the name. One round trip, then the session keys are in place.
6. HTTP
GET / with a Host header. The server answers 200 OK with HTML. The browser parses it and fetches CSS,
scripts and images, reusing connections (HTTP/2 multiplexes many requests on one connection).
7. What the network does underneath
- Access switches forward by destination MAC and VLAN.
- Every router hop rewrites source and destination MAC, decrements TTL, and picks the next hop by longest prefix match.
- The edge firewall or router translates the private source address and port to a public one (PAT) and keeps state so the reply comes back in.
- Replies may take a different path back (asymmetric routing), which stateful devices must tolerate.
They will ask next
What does the host do differently if the server is on its own subnet?
It ARPs for the server's IP directly and sends the frame straight to the server's MAC. The default gateway is only used when the destination is off subnet.
Where can this go wrong, and how would you tell which step failed?
Work up the steps. Link and IP config (
ipconfigorip addr), ARP for the gateway (arp -a), ping the gateway, DNS (nslookupordig), TCP to 443 (curl -vorTest-NetConnection -Port 443), then TLS and HTTP errors incurl -v. Each step has its own symptom.Why does the browser send the server name in the ClientHello?
That is SNI. One IP address can host many sites, so the server needs the name before it can choose which certificate to present.
Traps
- Skipping ARP and the default gateway. Interviewers listen for the local subnet decision.
- Saying DNS always uses TCP. Normal queries use UDP 53; TCP is used for large responses and zone transfers.