Chapter 2: The OSI Model and TCP/IP Model

2.4 Walk-through: what happens when you open a website?

By Ravindra Bagale · Last updated: 25 September 2026

This is my favourite interview question, so dhyan do. Suppose you type https://www.example.com in your browser and press Enter. What happens in the next few hundred milliseconds? Let's walk through it together.

 You ──► Browser ──► DNS lookup ──► TCP handshake ──► TLS handshake ──► HTTP GET
                                                                             │
 Page shown ◄── Browser renders ◄── HTTP 200 + HTML/CSS/JS ◄── Web server ◄──┘

1. URL parsing (L7): The browser finds the scheme (https → port 443), host (www.example.com) and path (/).
2. DNS resolution (L7, over UDP 53): The browser checks its cache, then the OS cache and /etc/hosts, then asks the configured DNS resolver (your ISP, 8.8.8.8, or on EC2 the VPC resolver at 169.254.169.253). The resolver queries root → .com TLD → authoritative name server and returns the IP, e.g. 93.184.215.14.
3. ARP (L2/L3): Your laptop needs the MAC address of the default gateway (Wi-Fi router) to send the first frame; ARP finds it.
4. TCP 3-way handshake (L4): Your laptop picks an ephemeral port (e.g. 51544) and sends SYN to 93.184.215.14:443; the server replies SYN-ACK; laptop sends ACK. Connection established.
5. Routing (L3): Packets travel through your router (NAT changes your private IP to the public IP), your ISP and many internet routers, each forwarding by destination IP.
6. TLS handshake (L6): Browser and server agree on encryption keys; the server presents its certificate, which the browser verifies.
7. HTTP request (L7): Browser sends GET / HTTP/1.1 with headers Host: www.example.com, cookies, etc.
8. Server processing: On AWS this could be: Security group allows 443 → Nginx receives request → serves a static file or proxies to an app (Node/Flask/PHP) → app queries the database → response generated.
9. HTTP response (L7): HTTP/1.1 200 OK plus HTML. The browser then requests CSS, JS and images (often over the same connection).
10. Rendering: Browser builds the DOM, applies CSS, runs JavaScript and shows the page.
11. Connection close / keep-alive: Connection reused for more requests, then closed with FIN/ACK.

Now open your terminal and try this with me — you can see several of these steps yourself:

# Step 2: DNS lookup
dig +short www.example.com
nslookup www.example.com

# Step 5: path taken by packets (install traceroute if missing)
traceroute www.example.com

# Steps 4, 6, 7, 9 in detail (verbose curl)
curl -v https://www.example.com -o /dev/null