End-to-End Network Connectivity Over the Public Internet
How a request actually travels from a user's device to a web server and back — the client and local network, the ISP access and aggregation layers, the public internet backbone and peering points, the destination ISP and server network, plus the DNS resolution, CDN, and security layers that sit alongside the path. Hover, tap, or focus any component or connection for its description and standard reference.
Hover, tap, or focus any component on the drawing (or a circuit below it) for details. Click to pin; move away or click again to clear.
Component Reference
Every component in the diagram above, grouped by network segment, with its role and the relevant standard.
1. Your Device / Client
User Device
The endpoint where a user session begins — laptop, smartphone, or tablet. Endpoint posture (patching, disk encryption, EDR) is the first line of defense; a compromised device undermines every control further down the path.
📘 NIST SP 800-53 (SI, CM controls)Apps / Browser
The client application layer that initiates HTTP(S) requests — browsers and native apps. TLS certificate validation, same-origin policy, and content-security-policy enforcement all happen here before a byte reaches the network.
📘 RFC 9110 (HTTP Semantics)Operating System
The OS enforces the local trust boundary — process isolation, the TCP/IP stack, DNS stub resolver, and certificate store. OS-level vulnerabilities (unpatched kernels, weak local privilege boundaries) are a common initial-access vector.
📘 CIS Benchmarks (OS hardening)2. Local Network (LAN)
Wi-Fi
The wireless hop between the device and the router. WPA3/WPA2-Enterprise, a unique pre-shared key, and a separate guest SSID keep an untrusted device on the local segment from reaching internal hosts directly.
📘 IEEE 802.11 / WPA3Router / Gateway
The home/office router performs NAT, runs the local DHCP server, and is the default gateway for every LAN device. Weak default credentials and unpatched router firmware are among the most common home-network compromise vectors.
📘 RFC 1918 (Private Addressing)Switch (if any)
An Ethernet switch extends wired ports off the router/gateway. Unmanaged switches offer no port security or VLAN separation — a single compromised device can see all broadcast traffic on the segment.
📘 IEEE 802.1Q (VLAN)3. ISP Access Network
Access Media (Fiber / Cable / DSL / 5G)
The last-mile physical medium connecting the subscriber to the ISP — fiber (PON), DOCSIS cable, DSL copper, or 5G cellular. Each has its own physical-layer security posture (fiber tapping is harder to do covertly than sniffing shared cable).
📘 ITU-T G.984 (GPON) / DOCSIS 3.1Access Node (ONT / CMTS / DSLAM / gNodeB)
The ISP-side termination point for the access media — an Optical Network Terminal for fiber, a Cable Modem Termination System for DOCSIS, a DSLAM for copper, or a 5G gNodeB. Aggregates individual subscriber links onto the ISP's access network.
📘 3GPP TS 38.300 (5G gNodeB)4. ISP Aggregation Network
BRAS / BNG
The Broadband Remote Access Server / Broadband Network Gateway authenticates subscriber sessions (PPPoE/IPoE), applies per-subscriber policy and rate limiting, and hands traffic off to the ISP's routed core.
📘 RFC 2516 (PPPoE)Aggregation Routers
Aggregation-layer routers concentrate traffic from many BRAS/BNG or access nodes onto fewer, higher-capacity links toward the ISP edge — the first tier where individual subscriber flows merge into shared infrastructure.
📘 MEF (Carrier Ethernet)Edge Routers (ISP)
The ISP's edge routers sit at the boundary between its own aggregation network and the public internet backbone, running BGP to exchange routes with upstream and peer networks.
📘 RFC 4271 (BGP-4)5. The Public Internet (WAN / Backbone)
Internet Backbone (Tier 1 / 2 / 3 ISPs)
The interconnected mesh of Tier 1 (no-transit-fee, global reach), Tier 2 (regional, buys some transit), and Tier 3 (local, buys all transit) ISPs that make up the public internet. No single entity controls it — routing is entirely emergent from BGP policy exchanged between autonomous systems.
📘 RFC 1930 (Autonomous Systems)Peering Points (IXPs)
Internet Exchange Points are physical facilities where multiple networks interconnect and exchange traffic directly (peering) instead of routing through a third-party transit provider — lower latency, lower cost, and a common location for DDoS scrubbing services to sit.
📘 RFC 7947 (BGP Route Server / IXPs)6. Destination ISP Network
Edge Routers (Destination ISP)
The destination-side ISP's edge routers receive inbound traffic from the public backbone via BGP-advertised routes and begin forwarding it down toward the aggregation and access layers serving the destination network.
📘 RFC 4271 (BGP-4)Aggregation Routers (Destination)
Aggregation-layer routers on the destination side that funnel traffic from the ISP edge down toward the border routers fronting the destination network — mirroring the same role the origin-side aggregation layer plays in reverse.
📘 MEF (Carrier Ethernet)Edge / Border Routers (Destination)
The border routers marking the handoff from the ISP's network into the destination organization's own infrastructure — typically the point where the customer's own routing policy and access-control lists begin to apply.
📘 RFC 8212 (Default EBGP Deny)Firewall / DDoS Protection
Perimeter firewalls and volumetric DDoS scrubbing sit at the edge of the destination network, filtering malicious and unwanted traffic — the first dedicated security control layer before traffic reaches the server network.
📘 NIST SP 800-41 (Firewall Policy)7. Destination Network (Server Network / Data Center)
Load Balancer / Reverse Proxy
Terminates inbound connections (often the TLS termination point), distributes requests across a pool of backend servers, and can absorb application-layer attacks before they reach origin infrastructure. Frequently doubles as a WAF enforcement point.
📘 RFC 7239 (Forwarded HTTP Extension)Web Servers
Front-tier servers (Nginx, Apache, IIS) that terminate HTTP requests, serve static assets, and proxy dynamic requests to the application tier. A common target for request-smuggling and known-CVE exploitation if left unpatched.
📘 RFC 9112 (HTTP/1.1)Application Servers
Runs the application's business logic and typically holds the credentials to reach the database tier — a high-value target where input validation, dependency hygiene, and least-privilege service accounts matter most.
📘 OWASP ASVSDatabase Servers
Holds persistent application and customer data. Should never be directly internet-reachable — access is mediated through the application tier, with encryption at rest, least-privilege database accounts, and audit logging as baseline controls.
📘 NIST SP 800-53 (SC-28, Protection at Rest)File / Object Storage
Object/blob storage (e.g. S3-compatible) for uploads, backups, and static assets. Misconfigured public-read buckets are one of the most common real-world cloud data-exposure incidents — access policy here deserves the same scrutiny as the database tier.
📘 CIS Benchmarks (Cloud Storage)8. Target Services / Application
Web Application
The end-user-facing web application — the outermost software layer a client actually interacts with, and the surface where OWASP Top 10 classes of vulnerability (injection, broken access control, SSRF) are exploited.
📘 OWASP Top 10APIs
REST/GraphQL/gRPC interfaces exposed for programmatic access. API-specific risks — broken object-level authorization, excessive data exposure, lack of rate limiting — are distinct enough from web-app risks to warrant the dedicated OWASP API Security Top 10.
📘 OWASP API Security Top 10Email Service
Inbound/outbound mail handling. SPF, DKIM, and DMARC records are the baseline controls preventing the domain from being spoofed for phishing, while inbound filtering defends against the single most common initial-access vector in real breaches.
📘 RFC 7208 (SPF) / RFC 7489 (DMARC)File Downloads
File-serving endpoints for documents, installers, and media. Content-type validation, malware scanning on upload, and signed/short-lived download URLs prevent this surface from becoming a malware-distribution or data-exfiltration channel.
📘 OWASP Unrestricted File UploadStreaming / Media
Real-time or on-demand audio/video delivery, typically fronted by a CDN. Token-based, time-limited playback URLs (signed cookies/URLs) prevent content hot-linking and unauthorized redistribution.
📘 RFC 8216 (HLS)Online Services
The broader catch-all of SaaS and hosted services an organization exposes — customer portals, payment processing, third-party integrations — each inheriting the full stack of controls described in every layer above it.
📘 ISO/IEC 27001 (ISMS)A. Name Resolution (DNS)
User Types Domain
The user enters a domain name (e.g. www.example.com) in the browser — a human-readable name that must be resolved to an IP address before any connection can be made. Every step that follows exists to answer that one lookup.
📘 RFC 1035 (DNS)Recursive Resolver (ISP / Public DNS)
A recursive resolver (run by the ISP or a public service like 1.1.1.1/8.8.8.8) performs the full lookup on the client's behalf, querying root, TLD, and authoritative servers in turn and caching the result. DNS-over-HTTPS/TLS encrypts this hop against on-path snooping and tampering.
📘 RFC 8484 (DNS over HTTPS)Root Name Servers
The 13 logical root server clusters (anycast across hundreds of physical sites) that answer with a referral to the correct TLD servers for a given query — the very top of the DNS delegation hierarchy.
📘 RFC 8109 (Root Priming)TLD Name Servers (.com, .net, etc.)
Top-Level-Domain servers (operated by the relevant registry, e.g. Verisign for .com) hold the delegation records pointing to the authoritative name servers for every domain registered under that TLD.
📘 ICANN TLD DelegationAuthoritative Name Servers (example.com)
The domain's own authoritative servers hold the actual DNS records (A/AAAA, MX, TXT, etc.). DNSSEC-signs responses here to let resolvers cryptographically verify they haven't been spoofed or cache-poisoned in transit.
📘 RFC 4033 (DNSSEC)Returns IP Address
The final resolved IP address (e.g. 93.184.216.34) is returned to the client and cached locally for the record's TTL — the client can now open a TCP/TLS connection directly to that address.
📘 RFC 1035 §3.2 (A Record)B. Content Delivery (CDN)
User Request (CDN)
When a CDN is in front of the origin, the user's request is intercepted at the network edge rather than traveling all the way to the origin server — the first decision point for whether the response can be served from a nearby cache.
📘 RFC 7234 (HTTP Caching)DNS / CDN Routing
CDN providers use anycast routing or geo-aware DNS responses to steer each request to the nearest healthy edge location, minimizing latency and spreading load away from the origin — and absorbing much of a volumetric DDoS attack in the process.
📘 RFC 1546 (Anycast)Best Edge Location
The selected edge point-of-presence checks its local cache for the requested object; on a cache miss it fetches from the origin once, then serves every subsequent nearby request from the cached copy until it expires.
📘 RFC 7234 (Cache-Control)Content Delivered
The response is returned to the client, typically over the same TLS connection terminated at the edge — meaning the CDN provider is itself inside the trust boundary and a common target for supply-chain and configuration-tampering attacks.
📘 RFC 8446 (TLS 1.3)C. Security & Protection
WAF (Web Application Firewall)
Inspects HTTP/S requests against signature and behavioral rules to block SQL injection, XSS, and other OWASP Top 10 attack patterns before they reach the application — a compensating control, not a substitute for fixing the underlying vulnerability.
📘 OWASP Top 10 / PCI DSS Req. 6.6DDoS Protection
Cloud scrubbing or on-prem appliances that absorb and filter volumetric (bandwidth-exhaustion), protocol (SYN flood), and application-layer (slow-loris) denial-of-service attacks before they saturate the link or the origin.
📘 NIST SP 800-61 (Incident Handling)IDS / IPS
Intrusion Detection/Prevention Systems inspect traffic against signature and anomaly-based rules — IDS alerts on a match, IPS actively drops the offending traffic inline. A core layer of the defense-in-depth model alongside the firewall.
📘 NIST SP 800-94 (IDPS Guide)SSL / TLS Encryption
Transport Layer Security encrypts data in transit end-to-end (or edge-to-edge with a CDN) and authenticates the server's identity via its certificate — the baseline confidentiality and integrity control for every hop in this diagram.
📘 RFC 8446 (TLS 1.3)D. Internet Supporting Services
DHCP
The Dynamic Host Configuration Protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to devices joining a network — eliminating manual per-host configuration.
📘 RFC 2131 (DHCP)Network Address Translation
NAT rewrites private RFC 1918 addresses to a shared public IP (and back for return traffic), letting many internal hosts share one public address — and incidentally hiding internal topology from the public internet.
📘 RFC 3022 (Traditional NAT)NAT (Gateway Device)
The router or firewall appliance that actually performs the NAT translation, maintaining a stateful table mapping internal (private-IP, port) pairs to (public-IP, port) pairs for the duration of each connection.
📘 RFC 3022 (Traditional NAT)Routing Between Networks
The general function of forwarding packets across interconnected networks toward their destination — combining static routes, IGPs (OSPF, IS-IS) within a network, and BGP between networks to find a working path.
📘 RFC 1812 (Router Requirements)BGP
The Border Gateway Protocol is how autonomous systems exchange routing information with each other — effectively the protocol that makes "the internet" a single reachable network rather than millions of disconnected ones. BGP hijacking (announcing routes you don't own) remains a real-world attack vector with no fully deployed cryptographic fix.
📘 RFC 4271 (BGP-4)Time Synchronization
Accurate, synchronized clocks (via NTP) are a quiet prerequisite for security: TLS certificate validation, Kerberos authentication, and log-correlation across systems during incident response all depend on clocks agreeing within a tight tolerance.
📘 RFC 5905 (NTPv4)NTP
The Network Time Protocol itself — a hierarchical system of stratum servers that synchronizes device clocks to within milliseconds of UTC. NTP amplification is also a well-known DDoS technique, which is why open/unauthenticated NTP servers are discouraged.
📘 RFC 5905 (NTPv4)Route Origin Validation
RPKI-based Route Origin Validation lets a network cryptographically verify that a BGP route announcement actually comes from the autonomous system authorized to originate that prefix — the primary real-world defense against BGP route hijacking.
📘 RFC 6811 (BGP Prefix Origin Validation)Peering / IX
Direct interconnection arrangements — either private peering links or shared Internet Exchange fabric — that let two networks exchange traffic without paying a third-party transit provider.
📘 RFC 7947 (BGP Route Server)Traffic Exchange
The bulk data flow actually carried across peering and IX interconnections — the physical realization of the routing decisions made by BGP, flowing between the autonomous systems that agreed to exchange it.
📘 MEF (Carrier Ethernet)Reference
Typical Protocols & Ports Used
The standard protocol-to-port mapping every network defender should recognize on sight: DNS (53), DHCP (67/68), HTTP (80), HTTPS (443), TLS (443), FTP (21/20), SFTP (22), IMAPS (993), POP3S (995), NTP (123), BGP (179), and ICMP (type 8/0 for ping). Anomalous traffic on unexpected ports is one of the simplest indicators of compromise to alert on.
📘 IANA Service Name & Port RegistryEnd-to-End Example Flow
The full lifecycle of a single request, tying every component above together: (1) user enters a URL, (2) DNS resolves it to an IP, (3) a TCP connection is established (SYN → SYN/ACK → ACK), (4) a TLS handshake follows if HTTPS, (5) the HTTP request is sent, (6) the server processes it and sends a response, (7) the response returns along the reverse path, and (8) the browser renders the content.
📘 RFC 9110 (HTTP) / RFC 8446 (TLS 1.3)Key Takeaways
The internet is a network of interconnected networks, not one owned system; data travels in discrete packets across many independent routers; DNS translates human-readable names to IP addresses; every layer — physical, network, and security — has to work together; and return traffic follows the reverse path of the original request, which is why stateful firewalls only need to permit the outbound leg.
📘 RFC 1122 / RFC 1123 (Internet Host Requirements)Connections & Traffic Flows
The traffic flow types that tie the diagram together — each shown as a colored line in the legend above.
User Data Flow
The primary forward path of a user's request as it travels from the client device, through the local network, ISP, public internet, and into the destination server infrastructure.
📘 RFC 1122 (Host Requirements)DNS Query Flow
The recursive DNS resolution path — from the client's stub resolver, to the recursive resolver, to root, TLD, and authoritative name servers, and back with the resolved IP address.
📘 RFC 1035 (DNS)Return / Response
The reverse path taken by response traffic — server processing results, DNS answers, and acknowledgements flowing back to the originating client along the same general route.
📘 RFC 9293 (TCP)Peering / Transit
Traffic exchanged between autonomous systems at peering points and via transit providers — the inter-network links that stitch independently operated networks into a single reachable internet.
📘 RFC 4271 (BGP-4)