# Before the First Byte — narration script

Runtime 6:49. Timecodes are when each chapter starts; the film's animation is keyed to these cue times, so a recorded voice-over should keep each line near its timecode.

## 0:00 · You typed a guess

- `0:01` Type democompany.com and press Enter. Nothing has been sent yet. The browser's first job is to guess what you meant.
- `0:10` The address bar is not a URL field. It's a guesser. Is this a hostname, or words to search for? A dot and a known ending say hostname, so it builds a URL.
- `0:25` You left out the scheme, so the browser supplies one. Most browsers now try https first. It lowercases the host, encodes anything illegal, and only then has a real address to work with.
- `0:41` Where it fails: guess wrong, and your words go to a search engine instead. Every later step depends on that guess.

## 0:52 · Finding the address

- `0:53` A hostname is for people. The network routes to numbers, so the browser must turn www.democompany.com into an IP address. That's DNS, the Domain Name System.
- `1:10` First it checks what it already knows: its own cache, then the operating system's. A recent answer costs nothing.
- `1:21` Otherwise, a resolver, usually your internet provider's, walks the tree from the right. A root server points to the servers for .com. They point to Demo Company's own name servers, which give the answer.
- `1:38` Fun fact: the whole internet's naming starts at thirteen root server names, lettered A to M. Behind those thirteen names stand well over a thousand machines around the world.
- `1:53` Every answer comes with a time to live, so the next lookup can be skipped. Where it fails: no such name. Chrome calls it DNS_PROBE_FINISHED_NXDOMAIN, and nothing further happens.

## 2:10 · The road there

- `2:11` With an address in hand, packets set off across the internet, router to router, network to network. Nobody plans the whole route. Each router just passes the packet one hop closer.
- `2:26` Every step from here is counted in round trips: a message out and an answer back.
- `2:33` A round trip has a floor no upgrade can lower. Light in fiber covers about two hundred kilometres each millisecond. A server across an ocean is many milliseconds away, every single trip.
- `2:49` Where it fails: packets go out and nothing comes back. The browser waits, then gives up with ERR_CONNECTION_TIMED_OUT.

## 3:00 · Shaking hands

- `3:00` Next, TCP opens a reliable channel, with a handshake. The browser says "let's talk", the server says "yes, let's", and the browser confirms.
- `3:13` That costs one full round trip before a single byte of the page can move. TCP then numbers every piece, resends what's lost, and puts it all back in order.
- `3:27` Where it fails: the machine is there, but nothing is listening on that port. The server refuses, and Chrome shows ERR_CONNECTION_REFUSED.

## 3:38 · Proving who answers

- `3:39` Over that channel, TLS adds encryption, and something just as important: proof of who is answering.
- `3:48` In TLS 1.3, browser and server agree on keys in one more round trip. The server sends its certificate. The browser checks that it names this host, hasn't expired, and was signed by an authority it trusts.
- `4:05` That check is what the padlock means. It's the difference between talking to Demo Company and talking to someone pretending to be Demo Company.
- `4:16` Where it fails: an expired or mismatched certificate. Chrome stops cold with "Your connection is not private", and most people sensibly turn back.

## 4:28 · Finally, the request

- `4:29` Only now does the browser send the request: a method, a path, and the host it wants.
- `4:36` Then it waits while the server works. The time until the first byte of the answer comes back has a name: time to first byte.
- `4:46` And Demo Company's first answer isn't the page. It's a redirect: 307, try www.democompany.com instead.
- `4:59` A redirect is a whole new request, sometimes with a new lookup and a new connection. Where it fails: redirects that point at each other, which Chrome stops with ERR_TOO_MANY_REDIRECTS. Or a server that answers with a 500 error, or very slowly.

## 5:18 · Count the trips

- `5:18` Add it up. A lookup, a handshake, a key exchange, and the request itself.
- `5:25` On a cold start that's about four round trips before the first byte, more with a redirect. At a hundred milliseconds a trip, nearly half a second, and the page hasn't begun.
- `5:38` That's why the web works so hard to skip trips. Browsers cache names and reuse open connections. HTTP/3, over QUIC, folds the TCP and TLS handshakes into one. Preconnect starts this work early, for a host you know you'll need.
- `5:58` And it's why you should link to the final address, not one that redirects. Every hop you add, the reader pays for.

## 6:07 · Watch it yourself

- `6:08` Open the Network panel, load Demo Company, and select the first request. The Timing tab names every step: DNS lookup, initial connection, SSL, request sent, and waiting for the server.
- `6:24` Reload, and most of those steps vanish. The name is cached and the connection is still open.
- `6:33` All of that, before the first byte. Next: what the browser does once the bytes arrive, and why one URL becomes seventy requests.