What happens when you open a website?
Lesson 6 of 6
6What happens when you open a website?
The big pictureYou type example.com, press Enter, and under a second later the page appears. In that second your device got an address, found the gateway, asked about a name, shook hands with a server, agreed on encryption keys with it, and asked for the page. It is the most famous interview question in networking, and after this lesson you can explain it step by step.
What the picture shows: Six stops in order. Each one needs the result of the one before: no DNS without an address, no TLS without a TCP connection.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture arriving in a new city to visit a friend. First the hotel gives you a room and a phone number (DHCP). You ask the front desk where the exit is (ARP for the gateway). You call directory enquiries to turn your friend's name into an address (DNS). You knock and they answer (TCP). You agree on a secret code so nobody understands your talk (TLS). Then you make your request: "give me the home page" (HTTP).
DHCP (UDP 67/68) uses the four DORA messages, Discover, Offer, Request, Ack, to hand out the address, mask, gateway, DNS server and lease time. ARP turns the gateway's IP into a MAC. DNS asks the resolver, which walks from the root to the TLD to the authoritative server and caches the answer for its TTL. TCP does a three-way handshake to 443. TLS 1.3 (RFC 8446) takes one round trip: a ClientHello with SNI and a key share, then a ServerHello with the certificate; the browser checks the certificate chain and the name. HTTP sends GET / and gets 200 OK. With HTTP/3, transport and encryption merge in QUIC over UDP.
Before You Start
📦Transport
You know the three-way handshake and ports.
🧭Routing
You know what the default gateway does.
The Core Idea
1The whole trip, stop by stop
Press "Next" to see each stop on its own, or "All" for the whole trip. Notice that the first messages have nothing to do with the site: your device gets itself ready first.
Opening a website, message by message
Pick a stage to isolate its messages, or walk through them in order. Each arrow is a real message you can see in Wireshark.
The whole picture: six stages and sixteen arrows before you see the first letter of the page, usually all within half a second. Press a stage to isolate it.
DHCP: get a number. Your device joins Wi-Fi with no address, so it broadcasts "can anyone give me one?". The router offers 192.168.1.20 with the mask, gateway and DNS server, and your device accepts. Four messages, DORA, on UDP 67 and 68.
ARP: find the gateway's door. Everything leaving your home goes through the gateway, and your device needs its MAC to put on the frame. It asks everyone once and keeps the answer.
DNS: ask the phone book. Your device asks the resolver for the address of example.com; the resolver knows it from cache or asks the root, then .com, then the authoritative server. It is UDP on port 53.
TCP: knock on the door. The three-way handshake opens a reliable connection to port 443: SYN, SYN-ACK, ACK. One full round trip before any data.
TLS: agree on a secret language. Your device offers ciphers; the server picks one and sends its certificate to prove it really is example.com. TLS 1.3 needs one round trip, then everything is encrypted.
HTTP: ask for the page. At last the browser sends GET / inside the encrypted channel and gets 200 OK with the page. Then it asks for images and fonts on the same connection.
2DHCP: where did your address come from?
When your device connects it knows nothing, so it shouts to the whole network (a broadcast): "is there a DHCP server?". The router offers an address, the device requests it, the router confirms. That is DORA. The address is leased for a set time, and the device renews it before it runs out.
169.254 did not come from the router. It means DHCP never answered, so the device made one up that cannot reach the internet. Look for the problem in the link to the router, not in the site.3DNS: the internet's phone book
Machines talk in numbers, people remember names. DNS turns the name into an address. Your device does not search by itself: it asks a resolver (usually at your provider, or one like 1.1.1.1), which asks the servers from the top down, then caches the answer so it never repeats the trip.
| Record | What it holds | Example |
|---|---|---|
A | An IPv4 address | 203.0.113.10 |
AAAA | An IPv6 address | 2001:db8::10 |
CNAME | An alias pointing to another name | www → example.com |
MX | The domain's mail server | 10 mail.example.com |
TXT | Free text, used for verification and mail policy | v=spf1 … |
NS | The domain's authoritative servers | ns1.example.com |
This is why a DNS change does not show for everyone at once: each resolver waits for its own TTL to run out.
# a resolver's cache in a few lines: answers live until their TTL runs out
cache = {}
def resolve(name, now):
hit = cache.get(name)
if hit and now < hit["expires"]:
return hit["ip"], "cache"
ip = "203.0.113.10" # pretend we walked root -> .com -> authoritative
cache[name] = {"ip": ip, "expires": now + 300} # TTL 300 seconds
return ip, "full lookup"
for t in (0, 10, 299, 301):
ip, how = resolve("example.com", t)
print(f"t={t:>3}s {ip} ({how})")4TLS and HTTP: the lock, then the request
The padlock in the browser means three things: what passes between you and the server is encrypted, nobody changed it on the way, and the server proved it owns the name with a certificate signed by an authority your device trusts. It does not mean the site itself is honest: a phishing site can have a padlock.
| Code | Meaning | Usually whose fault |
|---|---|---|
200 | OK | Nobody |
301 / 302 | Moved to another address | An intended setting |
404 | Page not found | The link or the content |
403 | Forbidden | Permissions |
500 | Error inside the server | The application |
502 / 504 | The gateway could not reach the server behind it | The network or the backend |
Each part of the link is used by a different stop on the trip.
from urllib.parse import urlsplit
url = "https://shop.example.com:8443/cart?item=42#top"
parts = urlsplit(url)
print("scheme :", parts.scheme, "-> TLS on top of TCP")
print("host :", parts.hostname, "-> asked of DNS")
print("port :", parts.port or 443)
print("path :", parts.path, "-> sent in the HTTP request")
print("query :", parts.query)
print("fragment:", parts.fragment, "-> never leaves the browser")Worked example
The task: a colleague says "the internet is down". You run ping 1.1.1.1 and it works, then ping example.com says "unknown host". Where is the problem? The answer: reaching the internet by number works, so DHCP, ARP and routing are fine. What failed is turning the name into a number: the problem is DNS. Check the DNS server in the device settings, or try nslookup example.com 1.1.1.1 to ask another resolver directly.
Myth vs Reality
| Myth | Reality |
|---|---|
| The padlock means the site is safe and trustworthy. | It means the connection is encrypted and with the name's owner; phishing uses padlocks too. |
| DNS is used once, when a site is registered. | It is asked on every visit unless the answer is cached and still valid. |
| A faster plan always opens pages faster. | Opening a page depends more on latency and round trips than on bandwidth. |
Where you meet it at work
🎤Interviews
"What happens when you type a URL?" is almost a fixed question in networking and systems interviews.
🛠️Support
Finding the stop that failed saves hours of guessing.
⚡Web performance
CDNs, HTTP/3 and DNS caching all exist to cut round trips.
Test your understanding
What is the order of the DHCP messages?
DORA: Discover, Offer, Request, Acknowledge.
A device has the address 169.254.12.7. What is most likely?
It is an address the device makes up when DHCP fails.
Which DNS record holds an IPv6 address?
A is for IPv4, AAAA for IPv6, which is four times longer.
You get 502 Bad Gateway. Where do you look first?
You reached the gateway and HTTP answered, so the problem is behind it.
What is the order of DHCP messages?
DORA: discover, offer, request, acknowledge.
Which DNS record maps a name to an IPv4 address?
AAAA is for IPv6, MX for mail, CNAME an alias.
Quick review cards
Check Your Understanding
Why does ARP come before DNS on the trip?
Because the DNS question is itself a packet that leaves through the gateway, and sending it needs the gateway's MAC.
What does the browser check in the certificate?
That the name matches the site, that it is in date, and that the signing chain ends at an authority it trusts.
A friend changed their site's address in DNS and some people still reach the old one. Why?
Their resolvers hold the old answer until its TTL runs out.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Official docs2
Articles2
Done with this lesson?
Sign in to save your progress.