Chapter 1 — How the Internet Works

Before anything else — DNS, TCP, TLS — you need to understand what the internet physically is and how data moves across it.

What is the Internet?

The internet is a global network of networks. Millions of devices — computers, phones, servers, routers — connected together by cables (copper, fiber optic) and wireless signals (Wi-Fi, 4G, 5G).

No single company owns the internet. It is a collection of Autonomous Systems (AS) — networks operated independently by ISPs (Comcast, AT&T), companies (Google, Netflix), universities, and governments — all agreeing to talk to each other using the same protocols.

Your Home Network (AS 65001)
    │
    └──► ISP Network (AS 7922 — Comcast)
              │
              └──► Internet Exchange Point (IXP)
                        │
                        ├──► Google (AS 15169)
                        ├──► Netflix (AS 2906)
                        └──► Amazon (AS 16509)

IP Addresses — Your Home Address

Every device on the internet has an IP address — a unique number that identifies it, like a home address.

IPv4

The original addressing scheme. Looks like four numbers separated by dots:

203.0.113.45

Each number is 0–255. That gives us 4.3 billion total addresses (2³²).

Problem: We have more than 4.3 billion devices in the world. We ran out of IPv4 addresses around 2011.

Solution 1: NAT (share one public IP among many devices) — covered below. Solution 2: IPv6 — a much bigger address space.

IPv6

A newer addressing scheme with vastly more addresses. Looks like eight groups of hex digits separated by colons:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

How many addresses does IPv6 give us?

• IPv4: 2³² = ~4.3 billion
• IPv6: 2¹²⁸ = 340 undecillion (340 followed by 36 zeros)

That is enough to give every grain of sand on Earth its own IP address — and still have addresses left.

IPv6 key differences from IPv4:

Private vs Public IP Addresses

Not all IPv4 addresses are real internet addresses. Some ranges are reserved for private networks (your home, office, data center):

10.0.0.0    – 10.255.255.255    (10/8)     — large private networks
172.16.0.0  – 172.31.255.255   (172.16/12) — medium private networks
192.168.0.0 – 192.168.255.255  (192.168/16)— home/small office networks

Your laptop probably has 192.168.1.x. Netflix's internal servers use 10.x.x.x.

These private addresses are not routable on the public internet — routers will drop packets with private source IPs. This is where NAT comes in.

Packets — Breaking Data into Pieces

Data does not travel as one continuous stream. It is broken into packets — small chunks, typically 1500 bytes or less.

Why packets instead of one big stream?

• If one part fails or gets corrupted, only that small packet is retransmitted — not the entire file.
• Multiple conversations can share the same physical link simultaneously (different packets interleave).
• Routers can make per-packet routing decisions — packets of the same stream can take different paths.

Each packet contains:

• Header: Source IP, destination IP, protocol, sequence number, length
• Payload: A chunk of your actual data

Your HTTP request (5000 bytes) gets split into:
  Packet 1: [Header | bytes   1–1460]
  Packet 2: [Header | bytes 1461–2920]
  Packet 3: [Header | bytes 2921–4380]
  Packet 4: [Header | bytes 4381–5000]

Each packet travels independently across the internet.
They may take different routes.
They are reassembled in order at the destination.

Routers — The Post Offices

A router is a device whose job is to read the destination IP of each incoming packet and forward it toward that destination.

Every router maintains a routing table — a list of IP prefixes and which direction (interface) to forward packets destined for that prefix.

Router at ISP core:
  Routing table:
  ┌─────────────────────────┬──────────────────┐
  │ Destination Prefix      │ Next Hop         │
  ├─────────────────────────┼──────────────────┤
  │ 52.38.0.0/16           │ Netflix (AS2906) │
  │ 142.250.0.0/15         │ Google (AS15169) │
  │ 0.0.0.0/0              │ Upstream router  │
  └─────────────────────────┴──────────────────┘

Packet arrives: Dst=52.38.36.82
→ Matches 52.38.0.0/16
→ Forward toward Netflix

Routers operate at Layer 3 (Network Layer) of the OSI model. They only look at IP addresses, not the content of packets.

TTL (Time to Live): Every IPv4 packet has a TTL field (0–255). Each router that forwards the packet decrements TTL by 1. If TTL reaches 0, the router drops the packet and sends an ICMP "Time Exceeded" message back. This prevents packets from looping forever.

traceroute to netflix.com:
  1  192.168.1.1 (your router)      1ms   TTL=64→63
  2  10.0.0.1    (ISP gateway)      5ms   TTL=63→62
  3  72.14.232.1 (ISP core)        12ms   TTL=62→61
  4  ...
  n  52.38.36.82 (Netflix edge)    25ms   TTL=xx→xx

NAT — Network Address Translation

The simple version: Your apartment building has ONE mailbox number on the street, but 50 apartments inside. The building manager has a list matching each apartment to a specific mailbox slot. When a letter comes in addressed to "123 Main St", the manager checks the list and delivers it to the right apartment.

NAT works the same way. Your home has ONE public IP address (assigned by your ISP), but many devices inside (laptop, phone, TV, etc.) all with private IPs.

Source NAT (S-NAT) — Outbound Traffic

When your laptop sends a packet out to the internet:

BEFORE (inside your home network):
  Source IP:   192.168.1.105  (your laptop's private IP)
  Source Port: 54321
  Dest IP:     52.38.36.82   (Netflix)
  Dest Port:   443

Your router performs S-NAT:
  Source IP:   203.0.113.45  (your public IP — assigned by ISP)
  Source Port: 54321
  Dest IP:     52.38.36.82
  Dest Port:   443

The router saves this translation in its NAT table:
  192.168.1.105:54321  ←→  203.0.113.45:54321

Netflix sees your request coming from 203.0.113.45 — it has no idea you're on 192.168.1.105 internally.

Destination NAT (D-NAT) — Inbound Traffic / Load Balancing

When Netflix's load balancer receives your packet:

BEFORE (arriving at Netflix's VIP):
  Source IP:   203.0.113.45  (you)
  Dest IP:     52.38.36.82   (Netflix VIP — the public address)
  Dest Port:   443

Netflix LB performs D-NAT:
  Source IP:   203.0.113.45
  Dest IP:     10.0.4.55     (a real backend server — private IP)
  Dest Port:   443

This is how load balancers work at L4 — they use D-NAT to redirect connections from one public VIP to many private backend servers.

NAT Table — How Return Traffic Finds Its Way Back

S-NAT table in your home router:
  Private Endpoint        Public Endpoint         State
  192.168.1.105:54321 ←→ 203.0.113.45:54321     ESTABLISHED
  192.168.1.107:55000 ←→ 203.0.113.45:55000     ESTABLISHED

When Netflix's response arrives at 203.0.113.45:54321:
  Router looks up NAT table → finds mapping → delivers to 192.168.1.105:54321

Why IPv6 Eliminates NAT

Every device gets a globally routable IPv6 address. No need to share a single public IP. Your laptop can directly communicate with Netflix's servers — end-to-end, no translation.

This also means:

• Better performance (no translation overhead)
• Easier peer-to-peer applications
• No NAT traversal hacks needed
• Every device is directly reachable (security implications — need proper firewalls)

How a Packet Travels Across the Internet (Step by Step)

Let us trace your Netflix request packet from your laptop to Netflix's server:

Step 1: Your laptop creates the packet
  Src: 192.168.1.105:54321  Dst: 52.38.36.82:443
  Data: [HTTP request]

Step 2: Packet arrives at your home router
  Router checks: Is 52.38.36.82 on my local network? NO
  Router performs S-NAT: 192.168.1.105 → 203.0.113.45
  Router looks up default route → forwards to ISP

Step 3: ISP's router receives packet
  Checks routing table for 52.38.0.0/16
  Finds path → Netflix (AS2906) via peering link
  Forwards packet

Step 4: Internet Exchange Point (IXP)
  Physical location where ISPs interconnect
  Packet crosses from your ISP's network to Netflix's network

Step 5: Netflix border router receives packet
  BGP routing: this packet is for 52.38.36.82
  Forwards to Netflix's internal network

Step 6: Netflix's load balancer (VIP 52.38.36.82)
  Performs D-NAT: 52.38.36.82 → 10.0.4.55 (real server)
  Forwards to backend

Step 7: Backend server receives packet
  Src: 203.0.113.45:54321  Dst: 10.0.4.55:443
  Processes request, sends response

Return journey (reverse of above, NAT translations reversed)

Each step takes microseconds to low milliseconds. The entire round trip (RTT) across a continent is typically 20–80ms.