Packet Life: google.com

Phase 0 — Browser Input & URL Parsing

URL PARSING

schemehttps:// hostgoogle.com port443 path/

HSTS preload → force HTTPS (no HTTP redirect needed)

Cache	Checked	Result
Browser DNS	in-process	MISS
/etc/hosts	OS file	MISS
OS resolver	nscd/stub	MISS
Router cache	DNS proxy	maybe
ISP resolver	recursive	→ query

HSTS & Preload

Chrome checks the HSTS preload list — google.com has been baked into it since the browser's earliest days. Even if the user typed http://, the browser switches to HTTPS automatically with no HTTP request. No 301 redirect over the wire.

chrome://net-internals/#hsts — inspect the local HSTS store.

Browser Architecture

Pressing Enter → UI thread → Network thread (a separate process). Chrome uses a multi-process architecture: each tab gets its own renderer process. The network service is a separate process with the privileges needed for sockets.

Phase 1 — ARP · L2 MAC Resolution

ARP PACKET STRUCTURE

L2 Ethernet dst:FF:FF:FF:FF:FF:FF src:AA:BB:CC:DD:EE:FF type:0x0806 (ARP)

ARP op:1=REQUEST sha:AA:BB:CC:DD:EE:FF spa:192.168.1.10 tpa:192.168.1.1 tha:00:00:00:00:00:00

Step	From	To	Dst MAC	ARP Op	Contents
→ click Next step

ARP — Address Resolution Protocol

Before sending the DNS query, your PC needs to know the gateway's MAC address. Is the target 192.168.1.1 in the same subnet? — no, it's the gateway. Check the ARP cache. Empty → send an ARP broadcast.

0 / 5

Phase 2 — DNS Resolution · Recursive Query

DNS QUERY PACKET

IP src:192.168.1.10 dst:8.8.8.8

UDP src::49152 dst::53

DNS QR:0=Query RD:1 QNAME:google.com. TYPE:A

Record	Value	TTL
A	142.250.185.78	300s
AAAA	2a00:1450:4001:81e::200e	300s
NS	ns1-4.google.com	345600s
MX	aspmx.l.google.com	600s

DNS Resolution

The stub resolver sends a recursive query to 8.8.8.8:53 (UDP). The RD=1 flag means "I want recursion." The resolver walks the chain: root → TLD → authoritative.

DoH / DoT — encrypted DNS

DNS-over-HTTPS (DoH): the query travels as an HTTPS POST to https://8.8.8.8/dns-query — invisible to the ISP.

DNS-over-TLS (DoT): TCP:853, TLS-encrypted. Chrome uses DoH by default when the provider supports it.

Happy Eyeballs (RFC 8305): the browser requests A and AAAA in parallel and uses whichever answers first.

DNS Query

Click Next step to walk through DNS resolution one step at a time, from the stub to the authoritative NS.

0 / 7

Phase 3 — TCP 3-Way Handshake · Connection Setup

TCP SEGMENT — SYN

TCP src-port:49200 dst-port:443

seq:ISN=1000 ack:0 flags:SYN win:65535

options: MSS=1460 SACK_PERM TS val/ecr WS=8

TCP Option	Value	Purpose
MSS	1460	Max Segment Size
SACK	permitted	Selective ACK
Timestamps	val/ecr	RTT measurement
Window Scale	×256	Receive window = 16MB

TCP Handshake

TCP establishes a connection in 1.5 RTT. The ISN (Initial Sequence Number) is chosen randomly to defend against attacks. The connection targets port 443 (HTTPS). Next comes the TLS handshake on top of TCP.

TCP Fast Open (TFO)

TFO (RFC 7413): on repeat connections, data can be sent along with the SYN. The browser stores a TFO cookie from the server. Saves 1 RTT.

TCP Initial Congestion Window: Google uses initcwnd=10 — the first 10 segments (≈14KB) without waiting for an ACK.

TCP Handshake Step

Click Next step.

0 / 5

Phase 4 — TLS 1.3 Handshake

TLS 1.3 vs 1.2	TLS 1.3	TLS 1.2
Handshake RTT	1-RTT	2-RTT
Resumption	0-RTT (PSK)	1-RTT (session)
Key Exchange	ECDHE only	RSA / ECDHE
Forward Secrecy	✓ always	ECDHE only
Certificate	encrypted	cleartext
Cipher suites	5 (modern)	37+ (legacy)

TLS 1.3 KEY SCHEDULE

ECDHE: x25519 — client and server exchange pubkeys
shared_secret = ECDHE(client_priv, server_pub)
handshake_secret = HKDF(early_secret, shared_secret)
app_traffic_key = HKDF(master_secret, ...)
AEAD: AES-256-GCM or ChaCha20-Poly1305

TLS 1.3 Handshake

TLS 1.3 completes in 1 RTT. The client already sends key_share in the ClientHello, so the server can compute the shared secret immediately and encrypt the Certificate. Everything after ServerHello is encrypted.

OCSP Stapling & CT

OCSP Stapling: the server attaches a signed OCSP response to the Certificate, so the client makes no separate request to the CA.

Certificate Transparency (CT): Google requires every certificate to be logged in public CT logs. Chrome verifies the SCT (Signed Certificate Timestamp).

QUIC / HTTP/3: at Google, TLS is built into QUIC — the handshake happens at the same time as the transport setup.

TLS Step

Click Next step to walk through the TLS handshake one step at a time.

0 / 5

Phase 5 — HTTP/2 Request · Server Processing · Response

HTTP/2 REQUEST HEADERS (HPACK compressed)

:method: GET
:scheme: https
:authority: www.google.com
:path: /
accept: text/html,application/xhtml+xml
accept-encoding: gzip, deflate, br
accept-language: ru-RU,ru;q=0.9
user-agent: Mozilla/5.0 Chrome/120...
cookie: NID=...; 1P_JAR=...

HTTP/2

HTTP/2 multiplexes requests over a single TCP connection. HPACK compresses the headers. The server can initiate a Server Push.

HTTP/2 vs HTTP/3 (QUIC)

Google supports HTTP/3 + QUIC. The browser opts in via the Alt-Svc header or an HTTPS DNS record. QUIC: UDP + built-in TLS 1.3 + multiplexing without HOL blocking. 0-RTT resumption. Connection migration — the connection survives an IP change (Wi-Fi→LTE).

HTTP/2 Step

Click Next step.

0 / 5

Phase 6 — Browser Rendering Pipeline

Metric	Good	Needs improvement
FCP First Contentful Paint	<1.8s	>3s
LCP Largest Contentful Paint	<2.5s	>4s
CLS Cumulative Layout Shift	<0.1	>0.25
INP Interaction to Next Paint	<200ms	>500ms
TTFB Time to First Byte	<800ms	>1800ms

Critical Rendering Path

Render-blocking resources: CSS in <head> blocks rendering — the browser waits for the CSSOM. JS without defer/async halts DOM parsing.

Preload Scanner: while the main thread parses HTML, a second thread is already fetching <link rel=preload> resources.

Compositor thread: transform/opacity animations stay on the compositor only (they don't trigger Layout+Paint).

Full timeline — a typical google.com

0ms
keystroke
~1ms
ARP (if not cached)
~5ms
DNS resolve (local PoP)
~20ms
TCP SYN→ACK (RTT)
~40ms
TLS 1.3 (1-RTT)
~45ms
HTTP/2 GET /
~100ms
TTFB (first byte)
~200ms
FCP — first paint