I Captured One Website Load in Wireshark (Every Packet Explained)

I opened one Wikipedia page, and 997 packets went back and forth in about two seconds. So I recorded every one of them with tcpdump, opened the file in Wireshark, and went through the important ones: DNS, the TCP handshake, the TLS handshake (including a post-quantum key exchange) and the HTTP request itself. This is the "what happens when you press Enter?" interview answer, checked against a real capture. ▶ Whiteboard version (my last video):    • What happens when you type a URL and press...   Chapters: 0:00 Intro 0:27 The setup 1:02 DNS 1:44 TCP handshake 2:26 TLS handshake 4:11 HTTP request 5:07 A real page 5:50 Faster: HTTP/3 6:36 Recap Try it yourself: install Wireshark, load a page, and use these four filters: dns tcp.flags.syn==1 tls.handshake http2 The setup: Firefox on Fedora Linux, a fresh profile, mobile data, an empty DNS cache. One page load, on one network, on one night, so your numbers will be different. To decrypt my own TLS traffic I used Firefox's key log file. Never share that file: it unlocks your traffic. Sources: TLS 1.3: RFC 8446 · TLS 1.2: RFC 5246 QUIC: RFC 9000 · HTTP/3: RFC 9114 HTTPS DNS record: RFC 9460 · Alt-Svc: RFC 7838 HTTP caching (Age header): RFC 9111 X25519MLKEM768 hybrid key exchange: RFC 10024 (ML-KEM: NIST FIPS 203) #Wireshark #Networking #TLS #DNS #HTTP3