Chapter 2: The OSI Model and TCP/IP Model
2.4 Walk-through: what happens when you open a website?
This is my favourite interview question, so pay attention. Suppose you type https://www.example.com in your browser and press Enter. What happens in the next few milliseconds? Come on, let's go through it step by step together.
हा माझा सगळ्यात आवडता इंटरव्ह्यू प्रश्न आहे, म्हणून लक्ष द्या. समजा तुम्ही ब्राउझरमध्ये https://www.example.com टाइप करून Enter दाबलं. पुढच्या काही milliseconds मध्ये काय काय होतं? चला, एकत्र स्टेप बाय स्टेप बघू.
ये मेरा सबसे पसंदीदा इंटरव्यू सवाल है, इसलिए ध्यान दो. मान लो आपने ब्राउज़र में https://www.example.com टाइप करके Enter दबाया. अगले कुछ milliseconds में क्या-क्या होता है? चलो, साथ में स्टेप बाय स्टेप देखते हैं.
You ──► Browser ──► DNS lookup ──► TCP handshake ──► TLS handshake ──► HTTP GET
│
Page shown ◄── Browser renders ◄── HTTP 200 + HTML/CSS/JS ◄── Web server ◄──┘
- URL parsing (L7): The browser finds the scheme (
https→ port 443), host (www.example.com) and path (/). - DNS resolution (L7, over UDP 53): The browser checks its cache, then the OS cache and
/etc/hosts, then asks the configured DNS resolver (your ISP,8.8.8.8, or on EC2 the VPC resolver at169.254.169.253). The resolver queries root →.comTLD → authoritative name server and returns the IP, e.g.93.184.215.14. - ARP (L2/L3): Your laptop needs the MAC address of the default gateway (Wi-Fi router) to send the first frame; ARP finds it.
- TCP 3-way handshake (L4): Your laptop picks an ephemeral port (e.g. 51544) and sends SYN to
93.184.215.14:443; the server replies SYN-ACK; laptop sends ACK. Connection established. - Routing (L3): Packets travel through your router (NAT changes your private IP to the public IP), your ISP and many internet routers, each forwarding by destination IP.
- TLS handshake (L6): Browser and server agree on encryption keys; the server presents its certificate, which the browser verifies.
- HTTP request (L7): Browser sends
GET / HTTP/1.1with headersHost: www.example.com, cookies, etc. - Server processing: On AWS this could be: Security group allows 443 → Nginx receives request → serves a static file or proxies to an app (Node/Flask/PHP) → app queries the database → response generated.
- HTTP response (L7):
HTTP/1.1 200 OKplus HTML. The browser then requests CSS, JS and images (often over the same connection). - Rendering: Browser builds the DOM, applies CSS, runs JavaScript and shows the page.
- Connection close / keep-alive: Connection reused for more requests, then closed with FIN/ACK.
Now open your terminal and try this with me – you can see many of these steps yourself:
आता टर्मिनल उघडा आणि माझ्यासोबत हे ट्राय करा – यातल्या बऱ्याच स्टेप्स तुम्ही स्वतः बघू शकाल:
अब टर्मिनल खोलो और मेरे साथ ये ट्राय करो – इनमें से बहुत से स्टेप्स आप ख़ुद देख पाओगे:
# Step 2: DNS lookup
dig +short www.example.com
nslookup www.example.com
# Step 5: path taken by packets (install traceroute if missing)
traceroute www.example.com
# Steps 4, 6, 7, 9 in detail (verbose curl)
curl -v https://www.example.com -o /dev/null
Troubleshooting using layers
Website not opening from your laptop? Work bottom-up: Is the instance running (L1)? Does it have a public IP and route to an IGW (L3)? Does the security group allow port 80/443 (L4)? Is Nginx listening (ss -tlnp)? Does DNS point to the right IP (L7)? Does the app return errors (L7)?
When Mauli Dairy calls to say "the site won't open", use the order from the note above: instance running → public IP and route → security group 80/443 → Nginx listening (ss -tlnp) → DNS → app errors. One command for each step, no guessing.
Mauli Dairy चा फोन आला की "साइट उघडत नाही", तर वरच्या नोटमधला क्रम वापरा: instance running → पब्लिक IP आणि route → सिक्युरिटी ग्रुप 80/443 → Nginx listening (ss -tlnp) → DNS → ॲप errors. प्रत्येक स्टेपला एक कमांड, अंदाज नाही.
Mauli Dairy का फ़ोन आया कि "साइट नहीं खुल रही", तो ऊपर वाले नोट का क्रम इस्तेमाल करो: instance running → पब्लिक IP और route → सिक्योरिटी ग्रुप 80/443 → Nginx listening (ss -tlnp) → DNS → ऐप errors. हर स्टेप के लिए एक कमांड, अंदाज़ा नहीं.
Ravindra Bagale's Tip
When a website won't open, talk through the troubleshooting layer by layer, out loud, like a checklist: instance running? → route and public IP? → security group port? → is the service listening? → DNS correct? → app errors? Interviewers like this structured approach far more than random guesses.
Ravindra Bagale's Tip – मराठी
Website उघडत नाही तेव्हा troubleshooting layers प्रमाणे, मोठ्याने, checklist सारखं बोला: instance running? → route आणि public IP? → security group port? → service listen करतो का? → DNS बरोबर? → app errors? Interviewers ना random अंदाजापेक्षा ही structured पद्धत खूप जास्त आवडते.
Ravindra Bagale's Tip – हिंदी
Website नहीं खुल रही तब troubleshooting layers के हिसाब से, ज़ोर से, checklist की तरह बोलो: instance running? → route और public IP? → security group port? → service listen कर रही है क्या? → DNS सही? → app errors? Interviewers को random अंदाज़े से ये structured तरीका बहुत ज़्यादा पसंद आता है.
Ravindra Bagale's Tip
Many students assume the server is down when ping fails. A security group blocks ICMP by default – so first test with curl -I http://<PUBLIC_IP> or on that port. No ping does not mean the server is off.
Ravindra Bagale's Tip – मराठी
बरेच students ping fail झाला की server down असं समजतात. Security group default ICMP block करतो – म्हणून आधी curl -I http://<PUBLIC_IP> किंवा त्या port वर test करा. Ping नाही म्हणजे server बंद असं नाही.
Ravindra Bagale's Tip – हिंदी
बहुत से students ping fail हुआ तो server down समझ लेते हैं. Security group default रूप से ICMP block करता है – इसलिए पहले curl -I http://<PUBLIC_IP> या उस port पर test करो. Ping नहीं मतलब server बंद, ऐसा नहीं है.
Lab
Chala, dig +short www.example.com, traceroute www.example.com aani curl -v https://www.example.com -o /dev/null chalva. Output madhe varchya 11 steps paiki kontya steps disat aahet te mark kara – resolved IP (step 2), TCP connect (step 4), TLS handshake (step 6) aani 200 status (step 9).