How the Internet Works

The Big Picture

The Internet is a network of networks — billions of devices connected through a hierarchy of local, regional, and global networks, all speaking the same set of protocols. Every interaction you have online, from loading a webpage to streaming video, involves data being broken into packets, routed across multiple networks, and reassembled at the destination.

The Internet is not a single technology but an architecture — a set of agreements about how to communicate, layered on top of each other. — Vint Cerf, co-designer of TCP/IP

Layered Architecture

Networking is organized into layers, each responsible for a specific concern. This separation lets you swap out physical media (copper to fiber) without changing how TCP works, or deploy a new application protocol without touching routing.

Packet Switching vs Circuit Switching

The Internet uses packet switching, not circuit switching (like traditional phone networks). This fundamental design choice is what makes the Internet resilient and efficient.

Physical Layer

Everything on the Internet ultimately comes down to physical signals — electrical voltages, pulses of light, or radio waves. The physical layer is responsible for converting bits (0s and 1s) into signals that can travel across a medium.

Transmission Media

How Bits Become Signals

Real networks use more sophisticated encoding schemes like Manchester encoding (clock embedded in signal), 4B/5B (Ethernet), QAM (Wi-Fi/cellular, encodes multiple bits per symbol), and PAM-4 (modern Ethernet, 2 bits per symbol using 4 voltage levels).

OSI vs TCP/IP Model

There are two major models for understanding network communication: the OSI model (7 layers, theoretical reference) and the TCP/IP model (4 layers, what the Internet actually uses). The OSI model is more granular; the TCP/IP model is more practical.

All 7 OSI Layers Explained

Encapsulation

As data moves down the stack, each layer wraps it with its own header (and sometimes trailer). This is called encapsulation. At the receiving end, each layer strips its header in reverse order.

IP (Internet Protocol)

IP is the network layer protocol that handles addressing and routing. Every device on the Internet has an IP address, and every packet contains source and destination IP addresses so routers know where to forward it. IP is connectionless and provides best-effort delivery.

IPv4 vs IPv6

IPv4 Packet Structure

Subnetting & CIDR

CIDR (Classless Inter-Domain Routing) replaced the old classful addressing (Class A/B/C). The notation /24 means the first 24 bits are the network portion, leaving 8 bits for hosts.

NAT (Network Address Translation)

Since IPv4 addresses are exhausted, NAT allows many devices to share one public IP. Your home router has one public IP but assigns private IPs (like 192.168.x.x) to your devices internally.

TCP (Transmission Control Protocol)

TCP provides reliable, ordered, error-checked delivery of a byte stream between applications. It is the workhorse of the Internet — HTTP, SSH, SMTP, FTP, and most application protocols run on top of TCP. TCP turns IP's unreliable packet delivery into a reliable communication channel.

TCP Segment Structure

Three-Way Handshake

Before any data flows, TCP establishes a connection using a three-way handshake. This synchronizes sequence numbers and confirms both sides are ready.

Connection Teardown (Four-Way)

Flow Control: Sliding Window

The receiver advertises a window size — how much data it can buffer. The sender never sends more than the window allows. This prevents a fast sender from overwhelming a slow receiver.

Congestion Control

TCP also limits sending rate to avoid congesting the network itself. The sender maintains a congestion window (cwnd) separate from the receive window.

UDP (User Datagram Protocol)

UDP is TCP's minimalist sibling. It provides a connectionless, unreliable transport — just source/destination ports and a checksum. No handshakes, no acknowledgments, no ordering, no flow control. This makes it fast and lightweight, ideal for applications that prefer speed over reliability.

TCP vs UDP

When to Use UDP

DNS (Domain Name System)

DNS is the phone book of the Internet. It translates human-readable domain names (like example.com) into IP addresses (like 93.184.216.34). Without DNS, you'd have to memorize IP addresses for every website. DNS is a hierarchical, distributed database — no single server has all the answers.

DNS Hierarchy

DNS Resolution Flow

Recursive vs Iterative Resolution

DNS Record Types

TTL and Caching

Every DNS record has a TTL (Time to Live) in seconds. Resolvers cache the record for that duration. Low TTL (60s) means faster propagation of changes but more DNS queries. High TTL (86400s = 1 day) reduces load but changes propagate slowly.

HTTP/1.1, HTTP/2, HTTP/3

HTTP (HyperText Transfer Protocol) is the application layer protocol that powers the web. It has evolved significantly over three major versions, each solving problems introduced by the previous one.

Evolution at a Glance

The Head-of-Line Blocking Problem

QUIC: The Foundation of HTTP/3

QUIC is a transport protocol built on UDP that provides connection-oriented, encrypted, multiplexed communication. It was developed by Google and standardized as RFC 9000.

TLS/SSL

TLS (Transport Layer Security) provides encryption, authentication, and integrity for communications over TCP. It's what makes HTTPS possible. SSL (Secure Sockets Layer) is the deprecated predecessor — modern "SSL" really means TLS.

What TLS Provides

Symmetric vs Asymmetric Encryption

TLS uses both: asymmetric crypto to securely exchange a symmetric key, then symmetric crypto for the actual data. This is called a hybrid cryptosystem.

TLS 1.3 Handshake (Full)

Certificate Authority Chain of Trust

TLS 1.3 vs 1.2 Improvements

Common Cipher Suites (TLS 1.3)

HTTPS

HTTPS is simply HTTP over TLS. It wraps every HTTP request and response in a TLS encrypted tunnel. The URL scheme changes from http:// to https://, and the default port changes from 80 to 443.

What HTTPS Protects

Man-in-the-Middle (MITM) Attack

Certificate Pinning

Certificate pinning defends against compromised CAs by hardcoding the expected certificate (or its public key hash) in the client application. If the presented cert doesn't match the pin, the connection is rejected — even if a CA signed it. Used in mobile apps and high-security scenarios.

Routing

Routing is how packets find their way from source to destination across the Internet — traversing dozens of routers across multiple networks. Each router makes a local forwarding decision based on the destination IP address and its routing table.

How Routing Works

Autonomous Systems (AS) and BGP

The Internet is divided into Autonomous Systems (ASes) — networks under a single administrative entity (an ISP, a company, a university). Each AS has a unique ASN (Autonomous System Number). BGP (Border Gateway Protocol) is how ASes exchange routing information with each other.

Traceroute Explained

traceroute works by sending packets with incrementing TTL values. Each router that decrements TTL to 0 sends back an ICMP "Time Exceeded" message, revealing its IP address.

Load Balancing

Load balancers distribute incoming traffic across multiple backend servers to improve availability, reliability, and performance. They sit between clients and servers, acting as a reverse proxy.

L4 vs L7 Load Balancing

Load Balancing Algorithms

Health Checks

CDNs (Content Delivery Networks)

A CDN is a globally distributed network of edge servers that cache content close to users. Instead of every request traveling to the origin server (possibly across the world), it is served from the nearest edge location. This reduces latency, offloads the origin, and improves reliability.

How CDNs Work

Anycast

Anycast is how CDNs route users to the nearest edge. Multiple servers in different locations all advertise the same IP address. BGP routing naturally sends packets to the closest one (in terms of network hops).

Cache Invalidation

What Happens When You Type a URL

The complete journey from pressing Enter on https://www.example.com/page to seeing a rendered page involves dozens of steps across every layer of the networking stack.

The Full Journey

WebSockets

WebSockets provide full-duplex, bidirectional communication over a single TCP connection. Unlike HTTP's request-response model, either side can send messages at any time without the other having to ask. This makes WebSockets ideal for real-time applications.

The Upgrade Handshake

A WebSocket connection starts as a regular HTTP request with an Upgrade header. The server agrees by responding with 101 Switching Protocols, and from that point forward the connection is a WebSocket.

WebSockets vs Alternatives

gRPC & Protocol Buffers

gRPC is a high-performance RPC (Remote Procedure Call) framework built by Google. It uses Protocol Buffers (protobuf) for serialization and runs on top of HTTP/2. It's widely used for microservice communication where performance matters.

Protocol Buffers vs JSON

gRPC Communication Patterns

gRPC Over HTTP/2

Internet Backbone

The physical structure of the Internet is a hierarchy of interconnected networks, from the massive global backbone carriers down to your local ISP. Understanding this hierarchy explains why some paths are faster than others and how the Internet stays connected.

ISP Tiers

Peering & Transit

Internet Exchange Points (IXPs)

An IXP is a physical building where hundreds of networks plug into a shared switch fabric and peer with each other. This keeps local traffic local — instead of packets from ISP-A to ISP-B in the same city going through a Tier 1 backbone across the country and back.

Physical Internet Structure