How the Internet Actually Works

It is not a cloud, not a series of tubes, and definitely not magic. Here is what actually happens when you type a URL and press Enter.

Not a Cloud

The internet is physical. It is copper cables, fiber optic strands, radio waves, and satellite links connecting billions of devices. Roughly 550 submarine cables, some stretching over 20,000 kilometers, carry 99% of intercontinental data traffic. When you send an email from New York to London, your data likely travels through a fiber optic cable lying on the Atlantic Ocean floor, protected by layers of steel wire, copper tubing, and polyethylene. Sharks occasionally bite these cables. This is a real operational concern.

The word "internet" is short for "internetwork," a network of networks. There is no single internet. There are tens of thousands of autonomous systems (AS), each independently operated by ISPs, corporations, universities, and governments. These networks agree to exchange traffic through peering arrangements and transit agreements. The internet exists because these networks choose to cooperate.

DNS: The Phone Book

When you type "example.com" into your browser, the first thing that happens is a DNS (Domain Name System) lookup. Your computer needs to translate that human-readable name into an IP address, a numerical identifier like 93.184.216.34 that routers can work with.

Your operating system first checks its local cache. If it has resolved this domain recently, it uses the cached result. If not, it asks a recursive resolver, usually operated by your ISP or a service like Cloudflare (1.1.1.1) or Google (8.8.8.8). The resolver may have the answer cached. If not, it begins a series of queries.

First, it asks a root nameserver (there are 13 root server clusters, operated by organizations including ICANN, Verisign, and NASA). The root server does not know the IP for example.com, but it knows which servers handle the .com top-level domain. The resolver asks the .com TLD server, which responds with the authoritative nameservers for example.com. Finally, the resolver asks one of those authoritative servers, which returns the actual IP address. This entire process typically takes 20 to 120 milliseconds.

TCP: The Reliable Channel

With the IP address in hand, your browser initiates a TCP (Transmission Control Protocol) connection. TCP provides reliable, ordered delivery of data. It begins with a three-way handshake: your computer sends a SYN packet, the server responds with SYN-ACK, and your computer replies with ACK. This handshake establishes a connection and synchronizes sequence numbers that will track the order of packets.

TCP breaks your data into segments, numbers them, and sends them. The receiver acknowledges each segment. If an acknowledgment does not arrive within a timeout period, the sender retransmits. This mechanism guarantees delivery but adds latency. For real-time applications like video calls and gaming, UDP (User Datagram Protocol) is often preferred because it sacrifices reliability for speed.

TLS: The Encryption Layer

Modern web traffic is encrypted using TLS (Transport Layer Security), the successor to SSL. After the TCP handshake, a TLS handshake negotiates encryption parameters. The server presents its digital certificate, which your browser validates against a list of trusted Certificate Authorities. They agree on an encryption algorithm and exchange keys. All subsequent data is encrypted.

TLS 1.3, finalized in 2018, reduced the handshake from two round-trips to one, improving performance significantly. The push toward universal HTTPS, led by browser vendors and initiatives like Let's Encrypt (which provides free certificates), means that the majority of web traffic is now encrypted.

HTTP: The Conversation

With a secure TCP connection established, your browser sends an HTTP (HyperText Transfer Protocol) request. A typical GET request includes the path you want, headers specifying what your browser accepts, cookies for authentication, and other metadata. The server processes the request and returns an HTTP response with a status code (200 for success, 404 for not found, 500 for server error), headers, and a body containing the requested content.

HTTP/2 (2015) introduced multiplexing (multiple requests over a single connection), header compression, and server push. HTTP/3 (2022) replaced TCP with QUIC, a UDP-based protocol that reduces connection setup time and handles packet loss more gracefully. Each version has improved performance while maintaining backward compatibility.

Routing: Finding the Path

IP packets do not travel directly from source to destination. They hop between routers, each making an independent forwarding decision based on the packet's destination address. Routers maintain routing tables, populated by protocols like BGP (Border Gateway Protocol), that indicate which neighboring router is the best next hop for a given destination.

BGP is the protocol that holds the internet together. It allows autonomous systems to announce which IP address ranges they can reach and to learn routes from their neighbors. BGP is remarkably fragile for something so critical. Misconfigurations have caused nationwide outages (Pakistan accidentally hijacked YouTube's IP addresses in 2008, and Facebook's BGP misconfiguration caused a six-hour global outage in 2021).

A single web request might traverse 15 to 20 routers across multiple autonomous systems. Tools like traceroute reveal this path, showing each hop and the time it takes. The route is not fixed. Changes in network conditions, equipment failures, or policy changes can alter the path between requests.

Content Delivery: Getting Closer

Content Delivery Networks (CDNs) like Cloudflare, Akamai, and Fastly improve performance by caching content at servers distributed around the world. When you request a webpage, a CDN serves it from a server geographically close to you rather than from the origin server, which might be on another continent. This reduces latency significantly.

DNS-based load balancing directs you to the nearest CDN edge server. Anycast routing, where the same IP address is announced from multiple locations, lets the network itself route you to the closest server. These techniques are invisible to users but essential for the responsiveness of modern web applications.

Peering and Transit: The Business of the Internet

The internet's physical infrastructure is owned and operated by thousands of independent organizations. How these organizations agree to exchange traffic is one of the most important and least understood aspects of how the internet works.

Peering is an arrangement where two networks agree to exchange traffic directly, usually without payment. This happens at Internet Exchange Points (IXPs), physical locations where networks connect their routers. Major IXPs like DE-CIX (Frankfurt), AMS-IX (Amsterdam), and LINX (London) handle terabits per second of traffic. Peering makes economic sense when two networks send roughly equal amounts of traffic to each other.

Transit is a paid arrangement where one network pays another for access to the entire internet. Small ISPs buy transit from larger ones. Large ISPs buy transit from Tier 1 networks, which are the roughly dozen networks (AT&T, Lumen, NTT, Cogent, among others) that can reach every destination on the internet through peering alone, without buying transit from anyone.

The business relationships between networks are the invisible infrastructure beneath the technical infrastructure. When a peering dispute occurs (as happened between Cogent and Sprint in 2008, or between Netflix and Comcast in 2014), large portions of the internet can become unreachable or slow. These disputes are resolved through business negotiation, not technical fixes.

The Protocol Stack in Practice

A complete web request traverses the full network protocol stack:

  1. Application layer: Your browser constructs an HTTP request ("GET /index.html HTTP/1.1").
  2. Transport layer: TCP segments the data, adds sequence numbers and checksums, and manages flow control.
  3. Network layer: IP adds source and destination addresses and handles routing decisions.
  4. Link layer: Ethernet (or Wi-Fi) frames the packet for transmission on the local network, adding MAC addresses.
  5. Physical layer: The frame is converted to electrical signals (copper), light pulses (fiber), or radio waves (wireless) for transmission.

At each router along the path, the packet is partially unwrapped (link and physical layers are removed), a routing decision is made based on the IP layer, and the packet is re-wrapped for the next hop's link and physical layers. This process, called decapsulation and re-encapsulation, happens at every hop, potentially 15-20 times for a single request.

The elegance of the layered model is that each layer is independent. You can replace Wi-Fi with Ethernet at the link layer without changing anything above it. You can switch from HTTP/2 to HTTP/3 at the application layer without changing the routing infrastructure. This modularity is why the internet can evolve incrementally rather than requiring coordinated upgrades.

Security at Every Layer

Security concerns exist at every layer of the network stack, and different threats require different countermeasures:

Physical layer: Submarine cables can be tapped (the NSA's Operation Ivy Bells tapped Soviet undersea cables during the Cold War). Fiber optic cables can be spliced to intercept light signals. Physical security of network infrastructure is a genuine concern for governments and large organizations.

Link layer: ARP spoofing allows an attacker on a local network to redirect traffic by claiming to be the gateway. MAC address filtering provides minimal security on wireless networks.

Network layer: IP spoofing (forging the source IP address) enables denial-of-service attacks. BGP hijacking (announcing false routes) can redirect traffic through an attacker's network. RPKI (Resource Public Key Infrastructure) is a nascent effort to secure BGP, but adoption remains incomplete.

Transport layer: TLS encrypts data in transit, preventing eavesdropping and tampering. Certificate transparency logs help detect fraudulently issued certificates.

Application layer: SQL injection, cross-site scripting, and authentication bypasses target application-level vulnerabilities. WAFs (Web Application Firewalls) and secure coding practices are the primary defenses.

The defense-in-depth principle acknowledges that no single layer's security is sufficient. Encryption (TLS) protects against network-level eavesdropping. Authentication (certificates, tokens) protects against impersonation. Input validation protects against injection attacks. Each layer's security compensates for the limitations of other layers.

IPv4 Exhaustion and IPv6

The internet was originally designed with 32-bit IP addresses (IPv4), providing approximately 4.3 billion unique addresses. This seemed inexhaustibly large in the 1980s but became a constraint as billions of devices came online. The last blocks of IPv4 addresses were allocated by IANA in 2011.

Network Address Translation (NAT), which allows multiple devices to share a single public IP address, has been the primary workaround. Your home router likely uses NAT to connect dozens of devices through a single ISP-assigned address. NAT works but breaks the end-to-end principle (the idea that any internet device should be able to communicate directly with any other) and creates complications for peer-to-peer applications.

IPv6, with 128-bit addresses providing roughly 340 undecillion unique addresses (enough for every atom on the surface of the Earth to have its own IP address), was designed as the long-term solution. IPv6 adoption has been slow but steady: as of 2024, Google reports that roughly 40% of its traffic arrives over IPv6. The transition has taken decades because IPv4 and IPv6 are not directly compatible, and most of the internet's infrastructure and software was built for IPv4.

Internet Governance: Who Runs It?

No single organization controls the internet, but several institutions coordinate its operation:

ICANN (Internet Corporation for Assigned Names and Numbers) manages the DNS root zone, allocates IP address blocks, and coordinates the domain name system. It is a nonprofit organization based in the United States, and its authority over internet naming has been a source of ongoing geopolitical tension.

IETF (Internet Engineering Task Force) develops and maintains internet standards through a consensus-based process. RFCs (Requests for Comments), the IETF's publication format, define protocols like HTTP, TCP, DNS, and TLS. Anyone can participate in IETF working groups, and standards are adopted based on rough consensus and running code.

Regional Internet Registries (RIRs) allocate IP addresses within their geographic regions: ARIN (North America), RIPE NCC (Europe), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa).

The Internet Society (ISOC) provides organizational support for the IETF and advocates for open internet policies.

This decentralized governance model reflects the internet's design philosophy: no single point of control. But it also creates friction when different stakeholders (governments, corporations, civil society organizations) disagree about policy issues like content moderation, surveillance, censorship, and data sovereignty.

The concept of "internet governance" has become increasingly contested. Countries like China (with the Great Firewall), Russia (with SORM surveillance), and Iran (with internet shutdowns during protests) have demonstrated that governments can exert significant control over internet traffic within their borders. The "splinternet" scenario, where the global internet fragments into national or regional networks with different rules, is a growing concern.

The Physical Reality

The physical infrastructure of the internet is vast and largely invisible. Roughly 550 submarine cables carry over 99% of intercontinental data traffic. These cables, typically about the diameter of a garden hose, are laid by specialized ships and maintained by teams that repair damage from anchors, earthquakes, and (occasionally) sharks. Landing stations where submarine cables meet terrestrial networks are critical infrastructure; the destruction of a landing station could sever connectivity for an entire region.

On land, internet traffic travels through fiber optic cables buried alongside roads and railways, through microwave links on towers, and through last-mile connections (copper DSL, coaxial cable, fiber to the home, or fixed wireless) to end users. Data centers, which house the servers that run web applications and cloud services, consume approximately 1-2% of global electricity. The largest data centers, operated by hyperscalers like Amazon, Google, Microsoft, and Meta, are industrial-scale facilities with their own power substations and cooling systems.

The physical internet is a reminder that the "cloud" is a marketing term, not a technical description. Every bit of data you send or receive travels through physical media, is processed by physical machines, and is stored on physical disks. The abstraction is useful but ultimately misleading.

The internet's resilience is remarkable but not unlimited. Coordinated attacks on critical infrastructure (DNS root servers, submarine cable landing stations, major IXPs) could disrupt global connectivity. The increasing centralization of internet services in a few large cloud providers creates concentration risk that the internet's decentralized design was meant to prevent.

Key Takeaways

The Remarkable Thing

The internet works because of agreements, both technical (protocols, standards) and social (peering, governance). No single entity controls it. The protocols were designed for resilience, routing around damage and adapting to failures. The remarkable thing about typing a URL and seeing a webpage is not that it works. It is that it works billions of times per day, across a patchwork of networks operated by organizations with competing interests, using protocols designed decades ago. The internet is not magic. It is engineering, cooperation, and a surprising amount of trust.