Deep dive · interactive
What really happens when you type google.com and hit Enter
I mapped the whole trip — every packet, protocol, and process — into a flowchart with the right shape for every step, phases colored by OSI layer, and the background work most diagrams leave out.
- distinct steps
- 29+
- network layers
- 6
- autonomous systems
- 70k+
- end to end
- 100–500ms
The packet map
Pick a route or something that can go wrong, then play it or step through it yourself. The dot is your request; the clock is roughly how long the trip has taken so far.
Cold caches, every step runs once and everything works.
Type google.com, press Enter
Each keystroke already ran autocomplete against your history and suggestions. Enter commits whatever is in the omnibox.
The flowchart
All 41 steps and 14 decisions, with every exit labelled: the answer that keeps the trip going, and 10 ways it can fail or retry. Tap a shape to read what it does, or play any outcome on the map.
Color = OSI layer
- L7 Application
- L6 Presentation · TLS
- L4 Transport
- L3 Network
- L2 Data link
- L1 Physical
Shape = kind of step
- Start / end
- Process
- Decision
- Message on the wire
- Cache / lookup
Every exit, labelled
- ✓Continues down the main line
- ✗Fails
- ↻Retries
- »Skips ahead
- ↺Starts over
Application
Turn what you typed into an address the network understands.
Each keystroke already ran autocomplete against your history and suggestions. Enter commits whatever is in the omnibox.
See it on the map»Search termSkips ahead
Send the text to the default search engine instead.
✓ URLThe omnibox looks for a scheme, a dot and a known top-level domain. “google.com” parses as a host, so the browser builds https://google.com/ instead of running a search.
See it on the map↺Not listedStarts over
Try http:// first, get a 301 to https://, and start the request again.
✓ Yes: HTTPS onlygoogle.com ships inside the browser's built-in HSTS list, so the browser never tries plain HTTP. It upgrades to HTTPS internally before a single packet leaves.
See it on the map»Cached responseSkips ahead
The worker answers from Cache Storage and the network is never touched.
✓ No match: use the networkIf the site registered a service worker, it intercepts the request first and may answer from its own cache.
See it on the map»HitSkips ahead
Use the cached IP and skip the whole DNS lookup.
✓ MissBrowser host cache, then the OS resolver cache and the hosts file. A warm cache answers in microseconds.
See it on the mapThe OS sends a UDP query on port 53 (or DNS-over-HTTPS) to the resolver it learned from DHCP, usually your ISP's or a public one like 8.8.8.8.
See it on the mapOn a miss the resolver walks the hierarchy: a root server points to the .com TLD servers, which point to ns1.google.com. Every answer is cached for its TTL.
See it on the map✗NXDOMAINFails
The name doesn't exist. The browser shows DNS_PROBE_FINISHED_NXDOMAIN and the trip ends.
↻TimeoutRetries
Retry after a second, then try the next configured resolver before giving up.
✓ NOERRORThe resolver either returns records (NOERROR), says the name doesn't exist, or never replies.
See it on the mapGoogle's name server returns A and AAAA records, something like 142.250.x.x. The same address is announced from dozens of places around the world.
See it on the map
Transport
Open a reliable, encrypted pipe to Google.
»YesSkips ahead
Skip TCP and TLS entirely and send the request on the open HTTP/2 connection.
✓ No: first visitBrowsers keep connections alive and pool them per origin. A warm one means no handshakes at all.
See it on the map»Yes (Alt-Svc)Skips ahead
QUIC over UDP: transport and TLS 1.3 set up together in one round trip, with no TCP handshake.
✓ No: use TCPIf a previous response (or a DNS HTTPS record) advertised HTTP/3 via Alt-Svc, the browser can use QUIC instead of TCP.
See it on the mapThe browser asks the OS for a TCP socket to 142.250.x.x:443. The kernel picks an ephemeral source port, which completes the connection's 5-tuple.
See it on the mapThe client picks a random initial sequence number and advertises its receive window, MSS and options like SACK and window scaling.
See it on the map↻No replyRetries
Resend the SYN after ~1 s, then 2 s, 4 s… and finally show ERR_CONNECTION_TIMED_OUT.
✗RSTFails
Nothing is listening on that port: ERR_CONNECTION_REFUSED.
✓ YesThe client waits on a retransmission timer for the server's reply.
See it on the mapThe server acknowledges the client's sequence number plus one and sends its own.
See it on the mapOne round trip in, the connection is ESTABLISHED. The client doesn't wait: the TLS hello rides in the very next flight.
See it on the mapSupported cipher suites, an X25519 key share, SNI = google.com so the server knows which certificate to use, and ALPN offering h2 and http/1.1.
See it on the mapThe server picks a suite and sends its key share, then (already encrypted) its certificate chain, a signature proving it holds the private key, and Finished. All in one flight.
See it on the map✗Untrusted or expiredFails
A full-page NET::ERR_CERT_* warning. No request is sent.
✗No shared cipherFails
The handshake aborts with ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
✓ Valid chain and hostnameThe browser checks the chain up to a root it trusts, the hostname, the expiry date and Certificate Transparency logs.
See it on the mapBoth sides derive the same session keys from the key exchange. TLS 1.3 costs one round trip (zero on resumption), and ALPN settles on h2.
See it on the map
Network
Wrap the request layer by layer and get it out of the house.
GET / with Host, User-Agent, Accept, cookies and Accept-Encoding, packed as an HPACK-compressed HTTP/2 HEADERS frame and encrypted into a TLS record.
See it on the mapThe kernel adds source and destination ports, sequence and ack numbers, flags and a checksum, splitting the data to fit the MSS.
See it on the mapSource 192.168.1.23, destination 142.250.x.x, TTL 64, protocol 6 (TCP).
See it on the map»YesSkips ahead
ARP for that host directly and deliver it on the local network.
✓ No: send to the gatewayThe routing table compares the address against the local subnet mask. Google isn't on your Wi-Fi, so the packet goes to the default gateway: your router.
See it on the map»CachedSkips ahead
Use the stored MAC address; no broadcast needed.
✓ Miss: broadcastTo build a frame the OS needs the router's MAC address. On a cache miss it broadcasts the question and the router replies with its MAC.
See it on the mapAn Ethernet or 802.11 frame wraps the packet with both MAC addresses and a CRC, then the network card turns the bits into voltage or radio symbols.
See it on the map
Internet
Cross 10–20 independent networks to reach Google.
The router swaps your private address and port for its public IP and a fresh port, and remembers the mapping so it can route the reply back to you.
See it on the mapOver cable, fiber or DSL to your ISP's edge router, the first hop outside your home.
See it on the mapEach of the 70,000+ autonomous systems advertises the address ranges it can reach. Your ISP picks the best AS path toward Google's AS15169, often through a direct peering link.
See it on the mapEvery router decrements the TTL, does a longest-prefix match in its forwarding table and sends the packet out the next interface. The frame is rebuilt each hop; the IP packet stays the same.
See it on the map↻Lost on a busy hopRetries
Duplicate ACKs (or a timeout) trigger a retransmit, and TCP halves its congestion window.
✗TTL hit 0Fails
A router drops it and sends back ICMP Time Exceeded. That's exactly what traceroute uses.
✓ ACKedNothing in IP guarantees delivery. TCP finds out from the acknowledgements that do, or don't, come back.
See it on the map
Server
Land on the nearest edge and the right machine behind it.
Because the same IP is announced from many points of presence, BGP naturally delivers you to the closest one, often in your own metro area.
See it on the map↻Backend downRetries
Health checks already pulled it from the hash ring; the next healthy one takes the connection.
✓ Healthy backendGoogle's Maglev load balancer hashes the connection's 5-tuple with consistent hashing, so every packet of this connection reaches the same frontend.
See it on the mapThe Google Front End decrypts the request, applies DoS protection and routing rules, and forwards it over Google's private backbone to the service that owns “/”.
See it on the mapIt reads your cookies, picks a locale and any experiments, renders the homepage HTML (much of it cached) and compresses it with Brotli or gzip.
See it on the map↺301 / 302Starts over
Follow the Location header and start over from DNS for the new host (for example www.google.com).
»304Skips ahead
Not Modified: reuse the cached copy, no body is sent.
✗5xxFails
Retry if the request is safe to repeat; otherwise show the server's error page.
✓ 200 OKThe status line decides what the browser does next.
See it on the map
Return
Bring the bytes home and turn them into pixels.
The response is encrypted, segmented and routed home, not necessarily along the same path. Internet routing is often asymmetric.
See it on the mapBytes are decoded and tokenized into the DOM tree. The preload scanner spots CSS, JS and images and requests them over the same connection.
See it on the mapStylesheets are parsed into the CSSOM. Nothing paints until render-blocking CSS arrives.
See it on the mapDOM and CSSOM combine into the render tree. Layout computes geometry, paint fills layers with pixels, and the GPU compositor puts them on screen.
See it on the mapUsually 100–500 ms after Enter, depending on what was cached, how far away the edge is and how busy the network is.
See it on the map