Ravindra BagaleCourses & study guides

3. OSI Model, TCP/IP Model, TCP vs UDP and the 3-Way Handshake

3.6 What Happens When You Open a Website?

By Last updated:

Ha majha avadta interview prashna aahe – aani networking cha sagla chapter ekatra baandhto. https://www.example.com type karun Enter dabla ki pudhchya kahi milliseconds madhe kay hota? Chala, step by step baghuya.

 You ──► Browser ──► DNS lookup ──► TCP handshake ──► TLS handshake ──► HTTP GET
                                                                             │
 Page shown ◄── Browser renders ◄── HTTP 200 + HTML/CSS/JS ◄── Web server ◄──┘
  1. URL parsing (L7): The browser finds the scheme (https → port 443), host (www.example.com) and path (/).
  2. DNS resolution (L7, over UDP 53): The browser checks its cache, then the OS cache and /etc/hosts, then asks the configured DNS resolver (your ISP, 8.8.8.8, or on EC2 the VPC resolver at 169.254.169.253). The resolver queries root → .com TLD → authoritative name server and returns the IP, e.g. 93.184.215.14.
  3. ARP (L2/L3): Your laptop needs the MAC address of the default gateway (Wi-Fi router) to send the first frame; ARP finds it.
  4. TCP 3-way handshake (L4): Your laptop picks an ephemeral port (e.g. 51544) and sends SYN to 93.184.215.14:443; the server replies SYN-ACK; laptop sends ACK. Connection established.
  5. Routing (L3): Packets travel through your router (NAT changes your private IP to the public IP), your ISP and many internet routers, each forwarding by destination IP.
  6. TLS handshake (L6): Browser and server agree on encryption keys; the server presents its certificate, which the browser verifies.
  7. HTTP request (L7): Browser sends GET / HTTP/1.1 with headers Host: www.example.com, cookies, etc.
  8. Server processing: On AWS this could be: Security group allows 443 → Nginx receives request → serves a static file or proxies to an app (Node/Flask/PHP) → app queries the database → response generated.
  9. HTTP response (L7): HTTP/1.1 200 OK plus HTML. The browser then requests CSS, JS and images (often over the same connection).
  10. Rendering: Browser builds the DOM, applies CSS, runs JavaScript and shows the page.
  11. Connection close / keep-alive: Connection reused for more requests, then closed with FIN/ACK.

Now open your terminal and try this with me — you can see several of these steps yourself:

# Step 2: DNS lookup
dig +short www.example.com
nslookup www.example.com

# Step 5: path taken by packets (install traceroute if missing)
traceroute www.example.com

# Steps 4, 6, 7, 9 in detail (verbose curl)
curl -v https://www.example.com -o /dev/null

Troubleshooting using layers

Website not opening from your laptop? Work bottom-up: Is the instance running (L1)? Does it have a public IP and route to an IGW (L3)? Does the security group allow port 80/443 (L4)? Is Nginx listening (ss -tlnp)? Does DNS point to the right IP (L7)? Does the app return errors (L7)?

Why this matters for security

Every step is an attack point and a defence point: DNS spoofing (step 2), ARP spoofing (step 3), SYN flood (step 4), MITM, fake certificates and SSL stripping when HSTS is missing (step 6), injection in the request (step 7), and vulnerable application code (step 8). Security engineers use this walk-through to explain where each control – DNSSEC and trusted resolvers, TLS with HSTS, WAF, secure coding – fits.

Ravindra Bagale's Tip

Ya prashnala khup students fakt "DNS, mag page yeto" evdhach sangtat. Structure vapra: DNS → TCP handshake → TLS → HTTP request → server → response → render, aani pratyek step la ek line bola. Security role sathi pratyek step la ek attack aani ek defence jodla tar interviewer impress hoto. Interviewer "anakhi deep" vicharla tar tya step madhe deep jaa.

Practice task

Explain this walk-through aloud in two minutes to a friend. Then run curl -v https://www.example.com -o /dev/null and mark in the output: the resolved IP, the TCP connect, the TLS handshake, the certificate details and the HTTP status.

Thodkyaat sangaycha tar

  • OSI has 7 layers (Application → Physical); remember PDUs: data, segment, packet, frame, bits.
  • Encapsulation adds headers going down; decapsulation removes them going up – exactly what Wireshark shows.
  • TCP/IP has 4 layers: Application, Transport, Internet, Network Access. Security groups work at L3/L4, WAF at L7.
  • TCP = reliable, connection-oriented, with flags; UDP = fast, connectionless, easy to spoof. DNS uses both.
  • Handshake: SYN → SYN-ACK → ACK. Open = SYN-ACK, closed = RST, filtered = no reply.
  • Opening a website: DNS → TCP → TLS → HTTP → server → response → render.

Samjla ka? Nasel tar handshake cha diagram punha kaadha. Part 1 sampla – aata pudhe jaauya Linux aani AWS EC2 kade!