“Where should I send this web request?”
You enter amazon.com.
The browser gives the name to the laptop’s operating system. Because this simulation assumes nothing is cached, the laptop must ask for a numeric destination.
amazon.comCINEMATIC CYCLES · SHADOW-FREE TYPOGRAPHY · SCROLLING THE BLENDER TIMELINE
LOADING NATIVE SCENE
“What is the Internet Protocol address for amazon.com?”
The laptop creates a Domain Name System question.
The question is placed inside a User Datagram Protocol packet addressed to the laptop’s configured recursive Domain Name System resolver.
Destination: resolver at 1.1.1.1, port 53“Can you deliver this to 1.1.1.1?”
The packet reaches the home router.
The router receives a local frame, removes that local wrapper, and inspects the packet’s destination Internet Protocol address. It does not interpret amazon.com inside the question.
Source: 192.168.1.25:53144 → Destination: 1.1.1.1:53“Does 1.1.1.1 match my Local Area Network?”
Is the destination inside the home network?
The router compares the destination with its local network prefix. The laptop is local; the resolver is not.
Local network: 192.168.1.0 through 192.168.1.255 → no match“No specific route matches. Where is my default route?”
Which route should carry it?
The router checks its routing table. The fallback entry points toward the Wide Area Network interface and the Internet Service Provider gateway.
Selected path: default route → Internet Service Provider gateway“Do I already have a mapping for this flow?”
Has this conversation been translated before?
The router checks its Network Address Translation table using the private source address, source port, destination address, destination port, and transport protocol.
No matching translation exists“Which outside port can represent this laptop?”
The router reserves a public-facing port.
It chooses an unused port on its public address and records a reversible mapping. That record is how the answer will find the correct device later.
192.168.1.25:53144 ↔ 203.0.113.42:62001“Ready for the public internet?”
The router changes the packet’s source.
The private source becomes the router’s public address and reserved port. The destination stays 1.1.1.1. The router updates the checksums, reduces the Time To Live value by one, and forwards the packet.
203.0.113.42:62001 → 1.1.1.1:53“Who owns public port 62001?”
The resolver answers the public address.
After completing the name lookup, the recursive resolver sends its answer back to the router’s public address and the mapped port.
1.1.1.1:53 → 203.0.113.42:62001“Port 62001 maps to which device?”
The router restores the laptop’s private destination.
The translation table points to the original laptop and port. The router rewrites the destination, updates the checksums, and delivers the answer inside the home network.
amazon.com → 198.51.100.80“Can I open a secure web connection to 198.51.100.80?”
Now the browser can contact the store.
The browser begins a new Hypertext Transfer Protocol Secure connection. Because this is a different conversation, the router creates a second Network Address Translation mapping.
192.168.1.25:54500 ↔ 203.0.113.42:62002“Are you there, and are we both ready?”
The laptop and server complete a three-message handshake.
Transmission Control Protocol begins with Synchronize, Synchronize and Acknowledge, then Acknowledge. These messages establish sequence numbers and confirm that data can travel in both directions.
Synchronize → Synchronize and Acknowledge → Acknowledge“Which security settings can we both use?”
The browser sends a Client Hello.
The Transport Layer Security message includes supported protocol versions, cipher choices, a random value, a key share, and the Server Name Indication value amazon.com.
Client Hello → amazon.com at 198.51.100.80:443“Here are my choices. Can you verify who I am?”
The server selects the settings and presents a certificate.
The Server Hello selects compatible security parameters. The server also sends a signed certificate for amazon.com, a key share, and proof that it controls the certificate’s private key.
Server Hello + certificate + key share“Does this certificate really belong to amazon.com?”
The browser validates the server certificate.
The browser checks the requested name, the validity dates, the signature chain leading to a trusted certificate authority, and the server’s proof of private-key possession.
Name ✓ Dates ✓ Trusted chain ✓ Signature ✓“Can we prove the handshake was not changed?”
Both sides derive the same encryption keys.
The exchanged key shares let the browser and server independently derive matching symmetric session keys. Finished messages authenticate the handshake transcript.
Shared secret → traffic keys → Finished messages“Please send the home page for amazon.com.”
The browser sends an encrypted web request.
A Hypertext Transfer Protocol request for the path /, plus the host name and other headers, is placed inside encrypted Transport Layer Security records. Observers can see packets, but not the request contents.
Encrypted request: method GET · path / · host amazon.com“Where is the distant edge endpoint?”
The encrypted request crosses the public internet.
Routers forward the packets hop by hop across many independent networks. The globe uses a deliberately simplified route from an illustrative home region to Seattle so the physical distance is visible.
Illustrative home region → public networks → Seattle“Which nearby edge endpoint can receive these records?”
The route reaches an Amazon edge endpoint near Seattle.
The last network hops deliver the encrypted records to the remote edge set. Seattle is illustrative: real traffic may reach a different location according to routing, capacity, and Amazon’s network design.
Public internet uplink → illustrative Seattle edge endpoint“Which application service should handle this?”
The Amazon edge endpoint accepts and decrypts the request.
The edge endpoint authenticates and decrypts the records, reads the web request, and routes it to an application service. The exact internal Amazon architecture is intentionally simplified here.
Edge endpoint → application service“What page shell, data, and resource references are needed?”
Application services assemble the response.
For this explainer, the server prepares the initial document plus references to stylesheets, scripts, fonts, and images. A real commerce site may involve many more internal services.
Document + data + resource references“Can I send the page back over our secure channel?”
The server returns a successful encrypted response.
A Hypertext Transfer Protocol 200 OK response is divided into encrypted Transport Layer Security records and carried over the reliable connection toward the router.
200 OK → encrypted records → 203.0.113.42:62002“Which device owns public port 62002?”
The router reverses the existing address translation.
The Network Address Translation table maps that public port back to the laptop’s private address and port. The router rewrites the destination and forwards the encrypted records inside the home network.
203.0.113.42:62002 → 192.168.1.25:54500“What does this page contain, and what else must I fetch?”
The browser decrypts and parses the document.
The browser authenticates and decrypts each record, parses the Hypertext Markup Language, and discovers references to stylesheets, scripts, fonts, images, and other resources.
Decrypt → authenticate → parse → discover resources“Where does every element go, and what should it look like?”
The browser lays out and paints the page.
Additional encrypted requests fetch page resources. The browser builds document and style trees, calculates layout, paints pixels, and runs scripts—turning network bytes into the store you can use.
Fetch resources → build trees → layout → paint → interactSIMULATION · DOCUMENTATION-ONLY ADDRESSES · NO LIVE NETWORK REQUEST