Career OS

How the Internet Works

Before domains, DNS, or hosting make sense, you need the layer underneath: how two computers anywhere on Earth find each other and exchange bytes.

⏱ ~12 min · 🟢 Beginner · Prerequisite: none

🎯 What you’ll be able to do

  • Explain the difference between an IP address, a port, and a socket
  • Describe why data travels as packets and when to use TCP vs UDP
  • Walk an interviewer through everything between “typing a URL” and “seeing the page”

The mental model

The internet is just computers mailing small packages to each other’s addresses. That’s the whole thing. Websites, email, video calls — all built on that one idea.

Two questions must be answered for any communication:

  1. Where is the other computer? → its IP address
  2. How do the bytes get there reliably?TCP/IP

IP addresses — the “where”

Every device on a network has an IP address: its location on the internet.

TypeLooks likeNotes
IPv4104.21.45.1232-bit, ~4.3 billion addresses — we ran out
IPv62606:4700:3033::6815:2d0c128-bit, effectively unlimited — the future

Humans can’t remember 104.21.45.12, so we invented domain names (ayrisglobal.com) plus a phonebook to translate them — that’s DNS (lecture 3). For now: a domain name ultimately resolves to an IP address.

Ports — the “which program”

One server (one IP) runs many programs. A port number says which program the bytes are for.

104.21.45.12 : 443   →  web server (HTTPS)
104.21.45.12 : 25    →  mail server (SMTP)
104.21.45.12 : 22    →  SSH (remote login)
PortService
80HTTP (insecure web)
443HTTPS (secure web) — the one you live on
25 / 587 / 465SMTP (sending email)
143 / 993IMAP (reading email)
22SSH

Key term: socket

Address + port = a socket. 104.21.45.12:443 is a complete “deliver here” instruction — the exact program on the exact machine.

Packets — the “how”, part 1

Your data isn’t sent as one blob. It’s chopped into packets — small chunks, each stamped with source + destination IP. They travel independently across many routers (possibly via different paths) and are reassembled at the other end.

"Hello world"  →  [He][llo][ wo][rld]  →  cross the internet  →  reassembled  →  "Hello world"

Why chunks? If one is lost, you resend that one — not the whole message.

TCP vs UDP — the “how”, part 2

TCPUDP
Guarantees delivery?Yes — resends lost packets, keeps orderNo — fire and forget
SpeedSlightly slower (handshake + checks)Faster
Used forWeb, email, file transfer — must be exactVideo calls, gaming, DNS — fast beats perfect

The TCP 3-way handshake — the “are you there?” before any real talk. You’ll hear this term forever:

Client → SYN      ("can we talk?")
Server → SYN-ACK  ("yes — can you hear me?")
Client → ACK      ("yes, let's go")

This round trip happens before every normal web request. It’s why latency (distance to the server) matters so much — and why CDNs (lecture 6) put servers physically close to users.

The full request lifecycle

What actually happens when you visit a site:

1. DNS:       ayrisglobal.com → 104.21.45.12        (phonebook lookup)
2. TCP:       open connection to 104.21.45.12:443   (3-way handshake)
3. TLS:       agree on encryption keys              (the 🔒 — lecture 6)
4. HTTP:      "GET /  please"                        (the actual request)
5. Response:  server returns HTML                    (your page)
6. Render:    browser draws it, fetches CSS/JS/imgs  (repeat 1–5 per asset)

Every visit, every time. Internalize these 6 steps — most of this whole track is just expanding one of them.

Steps 4–5 are the HTTP exchange itself — the request your browser sends and the response the server returns. Press ▶ Play to watch the whole journey of one page load:

DNSTCPTLSRequestResponseRender

1 · DNS. The name ayrisglobal.com is turned into an IP address (104.21.45.12). You can’t connect to a name — only to a number.

DNSTCPTLSRequestResponseRender

2 · TCP. A 3-way handshake (SYN / SYN-ACK / ACK) opens a reliable connection to that IP on port 443.

DNSTCPTLSRequestResponseRender

3 · TLS. Because it’s HTTPS, both sides agree on encryption keys, so nobody in between can read the traffic.

DNSTCPTLSRequestResponseRender

4 · Request. Your browser sends GET / HTTP/1.1 with headers (like your auth token) — “please give me the page.”

DNSTCPTLSRequestResponseRender

5 · Response. The server does its work and replies with a status (200 OK) plus the HTML/JSON body.

DNSTCPTLSRequestResponseRender

6 · Render. The browser paints the page. All of this happened in a few hundred milliseconds — every single visit.

Quick check

⚠️ Common misconceptions

MythReality
”A domain is the website.”A domain is just a name that points to an IP. The website is files on a server at that IP.
”One IP = one website.”One IP can host thousands of sites (shared hosting, CDNs). The host name in the request disambiguates.
”HTTPS makes a site trustworthy.”HTTPS only proves the connection is encrypted and you reached the real domain. Scam sites have HTTPS too.
”The internet = the web.”The web (HTTP) is one service on the internet. Email, video, games are others.

🧪 Try it yourself

# What IP does a domain resolve to?
nslookup ayrisglobal.com

# Trace the actual hops your packets take across the planet
tracert google.com        # Windows
traceroute google.com     # Mac/Linux

# Watch a full request happen, verbosely (DNS → TCP → TLS → HTTP)
curl -v https://example.com

Tip

Run tracert google.com once. Watching your packets jump through 10–15 routers across the world to reach a server is the moment the internet stops being abstract.

Check Yourself

What's the difference between an IP address and a port?

The IP address is which machine on the internet. The port is which program on that machine. Together (a socket) they pinpoint an exact destination, e.g. 104.21.45.12:443 = the web server on that host.

Why is data sent as packets instead of one big blob?

Resilience and efficiency: packets can take different routes, and if one is lost only that small chunk is resent — not the entire message. It also lets many conversations share the same links.

When would you choose UDP over TCP?

When speed and low latency matter more than perfect delivery, and a dropped packet is survivable — video calls, live gaming, DNS lookups.

Walk through everything between typing a URL and seeing the page.

DNS resolves the name to an IP → TCP 3-way handshake opens a connection → TLS handshake sets up encryption → HTTP request is sent → server responds with HTML → browser renders and fetches CSS/JS/images (repeating the cycle per asset).

What are the three messages of the TCP 3-way handshake, and what does each mean?

SYN (client: “can we talk?”) → SYN-ACK (server: “yes — can you hear me?”) → ACK (client: “yes, let’s go”). It’s the setup round trip that happens before any real data flows on a TCP connection.

Why does the physical distance to a server affect how fast a site feels?

Each connection involves at least one round trip (the handshake, plus more for TLS and the request). The further away the server, the longer every round trip takes — that round-trip time is latency. CDNs fix this by putting copies of the server physically close to the user.

How can one IP address host thousands of different websites?

The HTTP request carries the host name you asked for. The server reads that name and serves the matching site. Shared hosting and CDNs rely on this — the IP alone doesn’t identify the site.

Does HTTPS mean a website is safe to trust? Why or why not?

No. HTTPS only proves the connection is encrypted and that you reached the real domain you typed. A scam site can get a valid HTTPS certificate just as easily. The lock means “private,” not “trustworthy.”

Still Unclear?

Paste any of these into Claude and have it drill you:

Quiz me on the 6-step request lifecycle (DNS → TCP → TLS → HTTP → response →
render). Give me one step at a time, ask me what happens, and correct me.
I keep confusing IP addresses, ports, and sockets. Give me 5 real-world analogies
and 5 quick examples, then test me until I get them right.
Explain TCP vs UDP using a different example than video calls and web pages, and
ask me to justify which one I'd pick for 3 new scenarios.

Why AI Can’t Do This For You

AI can recite the 6 steps perfectly. But when a page is “slow” or “won’t load” in production, you are the one staring at a tracert output, a hung TCP connection, or a DNS that resolved to the wrong IP — and you have to know which of the 6 steps broke. That diagnosis is pattern recognition built from running these commands yourself, not from reading the explanation. Run tracert and curl -v until the lifecycle is something you see, not something you recite.

📚 Resources

🧾 Key terms

IP address · location of a machine · Port · which program on it · Socket · IP + port · Packet · a chunk of data · TCP · reliable, ordered delivery · UDP · fast, no guarantees · Handshake · the setup round-trip before data flows · Latency · time for a round trip (driven by distance).

One-line summary

The internet is computers sending packets to IP:port sockets, reliably via TCP. A website visit is: DNS → TCP → TLS → HTTP → response → render.

Module done? Add it to today’s tracker

Saves your progress on this device.