The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

What happens when you type a URL into a browser?

2026.09.05//8 MIN READnetworkinghttpdnsweb-security

// Entering the URL

When you type a URL into your browser’s address bar, the first thing that happens is a request to resolve that URL to an IP address. This process involves several steps, often overlooked but crucial for understanding how the web operates.

// Step 1: DNS Resolution

The Domain Name System (DNS) translates the human-readable domain name into an IP address. Here’s how it works:

1. Browser Cache: The browser checks its cache for the IP address. If it finds it, it skips the remaining steps. 2. Operating System Cache: If not found, the browser queries the operating system’s DNS cache. 3. DNS Resolver: If the OS cache is also empty, the request is sent to a DNS resolver, usually provided by your ISP. 4. Recursive Query: The resolver performs a recursive query to find the authoritative name server for the domain. 5. Root Name Server: The resolver contacts a root name server, which directs it to a TLD (Top Level Domain) name server (e.g., .com, .org). 6. TLD Name Server: The TLD name server points the resolver to the domain’s authoritative name server. 7. Authoritative Name Server: Finally, this server returns the corresponding IP address back to the resolver, which caches it for future use.

Example Command

To see the DNS resolution in action, use the dig command:

$ dig example.com

Output Explanation:

  • The ANSWER SECTION will display the resolved IP addresses.

// Step 2: Establishing a TCP Connection

Once the IP address is obtained, the browser initiates a TCP connection with the server. This process is known as the TCP three-way handshake:

1. SYN: The browser sends a SYN (synchronize) packet to the server to initiate a connection. 2. SYN-ACK: The server responds with a SYN-ACK (synchronize-acknowledge) packet. 3. ACK: The browser sends an ACK (acknowledge) packet back to the server, completing the handshake.

Checking Connection with telnet

You can verify the TCP connection using:

telnet example.com 80

If successful, you’ll see a blank screen indicating a connection.

// Step 3: Sending the HTTP Request

With the TCP connection established, the browser sends an HTTP request to the server. Here’s a simple example of an HTTP GET request:

GET / HTTP/1.1
Host: example.com
Connection: keep-alive

This request asks the server for the homepage. The Host header indicates which domain the request is for, allowing the server to handle multiple domains on the same IP address.

// Step 4: Server Response

Upon receiving the request, the server processes it and sends back an HTTP response, typically including:

  • Status Line: Indicates the status of the request (e.g., 200 OK).
  • Headers: Metadata about the response, such as content type and length.
  • Body: The actual content of the requested resource, often HTML.

Example HTTP Response

A typical response might look like this:

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 1256

<html><body><h1>Welcome to Example</h1></body></html>

// Step 5: Rendering the Web Page

After receiving the response, the browser begins rendering the web page. It parses the HTML, applies CSS styles, and executes any JavaScript. During this process:

  • Additional resources (images, stylesheets, scripts) may be requested, repeating the earlier steps for each.
  • The browser may also cache resources for future requests.

// Common Mistakes and Considerations

  • DNS Caching: If you change the DNS records, remember that caches may hold old records, causing delays in updates.
  • HTTP/2 vs. HTTP/1.1: Be aware of the differences in performance and multiplexing capabilities between HTTP/2 and HTTP/1.1.
  • Security: Always consider HTTPS over HTTP to ensure data integrity and privacy during transmission.

// Workflow Checklist

  • [ ] Check browser cache for DNS resolution.
  • [ ] Monitor the TCP connection using tools like tcpdump or Wireshark.
  • [ ] Analyze HTTP requests and responses with browser developer tools.
  • [ ] Consider implementing caching and security best practices for web applications.

In conclusion, understanding the steps that occur when you enter a URL can provide valuable insights into networking and web application behavior. This knowledge is fundamental for security assessments and optimizing performance. Remember, this process should only be practiced in environments you own or control, such as disposable lab ranges or authorized assessments. The DaemonCore Academy curriculum is freely available, offering opportunities to deepen your understanding of these concepts.