How the Internet Works: Packets, Routers and Latency
The internet is a worldwide network of thousands of independent networks that agree to exchange small chunks of data called packets using shared rules (protocols) such as IP, TCP, DNS and HTTP. Each packet is passed from router to router until it reaches its destination, which is why distance, the number of hops and congestion along the path all shape latency.
On this page
- What is the internet, really?
- What is a packet and why is data split up?
- The layers: how the protocols fit together
- Addresses: how packets know where to go
- Routers, hops and how a packet finds its way
- ISPs, transit and peering: who connects to whom
- Physical infrastructure: cables, data centres and edges
- What happens when you open a web page?
- Worked example: tracing 3 ms, 20 ms and 150 ms
- Where does the delay come from?
- How can you see this on your own connection?
- Common mistakes and myths
- What to do next
Quick answer: the internet is a network of networks. Thousands of independently run networks are linked together and agree to pass small chunks of data, called packets, to one another using shared rules called protocols. When you open a web page, your device looks up the server's address, opens a connection, exchanges a few messages to set up encryption, and then requests the page. Every one of those steps is carried as packets that hop from router to router, so the total delay (latency) depends on how far the packets travel, how many networks they cross and how busy those networks are.
What is the internet, really?
The internet is not a single company, building or cable. It is a collection of tens of thousands of separately operated networks, each called an autonomous system (AS) and identified by a number. Internet service providers (ISPs), universities, large companies, cloud providers, content providers and mobile carriers each run their own networks, and they connect them to each other. What makes it one internet is that all of them speak the same set of protocols, above all the Internet Protocol (IP).
It helps to separate three things people often blur together:
- The internet is the infrastructure: links, routers, addresses and the protocols that move packets.
- The web is one application on top of it: pages and apps fetched with HTTP or HTTPS.
- Your local network (Wi-Fi or Ethernet at home or in the office) is the first few metres of the path, not the internet itself.
What is a packet and why is data split up?
Data on the internet is not sent as one continuous stream down a reserved wire, as with an old telephone call. A message is cut into packets. On most Ethernet-based networks a packet is at most about 1,500 bytes, the usual maximum transmission unit (MTU). Each packet carries a header with the source address, the destination address and control fields, followed by a slice of the actual data (the payload).
This design, called packet switching, has several advantages. Many conversations can share the same link at once. If one path fails, later packets can take another route. A lost or damaged packet can be resent without restarting the whole transfer. The cost is that packets can arrive late, out of order or not at all, and something has to deal with that. That something is usually the transport protocol, covered in TCP and UDP explained.
As an example, a 3 MB photo is roughly 2,000 packets of about 1,460 bytes of payload each, once headers are accounted for. Your device sends or receives all of them, and the receiving side puts them back in order.
The layers: how the protocols fit together
Internet protocols are organised in layers. Each layer handles one job and relies on the layer below it. The common four-layer description (the "TCP/IP model") looks like this:
| Layer | Job | Examples |
|---|---|---|
| Application | What programs say to each other | HTTP and HTTPS, DNS, SMTP email, SSH |
| Transport | Delivery between two programs, using port numbers | TCP, UDP, QUIC (which runs over UDP) |
| Internet | Addressing and routing between networks | IPv4, IPv6, ICMP |
| Link | Moving bits over one physical hop | Ethernet, Wi-Fi, fibre, 4G and 5G radio |
When you load a page, your browser creates an HTTP request (application layer). It is handed to TCP or QUIC, which adds port numbers and reliability features (transport). IP adds the source and destination addresses (internet). The network card or radio puts the result onto a cable or into the air (link). At each router on the way, only the lower layers are examined: the router reads the IP destination address and decides where to send the packet next, without caring that the payload is a web page.
Addresses: how packets know where to go
Every device that talks on the internet needs an IP address. IPv4 addresses look like 203.0.113.25; IPv6 addresses are longer, such as 2001:db8::25. Most home devices have a private address that is shared behind a single public address through network address translation. All of this is covered in IP addresses, IPv4, IPv6 and NAT.
People prefer names to numbers, so the Domain Name System (DNS) translates a name such as example.com into the IP addresses that serve it. This is a lookup that happens before almost every new connection, and it is explained in DNS explained.
Routers, hops and how a packet finds its way
A router is a device with several network connections that forwards packets between them. When a packet arrives, the router looks at the destination IP address, finds the best matching entry in its routing table and sends the packet out of the corresponding link towards the next hop. One router-to-router step is called a hop. A typical path across the internet crosses roughly 8 to 20 hops, though this varies widely.
Routers do not know the whole path, only the next step. Each IP packet also carries a time to live (TTL) value, a counter reduced by one at every hop. If it reaches zero the packet is discarded, which stops packets from circulating forever if there is a routing loop. The traceroute tool uses this behaviour on purpose: it sends packets with TTL 1, 2, 3 and so on, and each router that discards one reveals itself.
The routing tables are filled in by routing protocols. Inside one network, interior protocols handle it. Between networks, the Border Gateway Protocol (BGP) is used: each network announces which address ranges it can reach and through which neighbours, and routers choose among the options using business policies as well as path length. The shortest geographic path is therefore not always the one used. See routing, BGP and peering.
ISPs, transit and peering: who connects to whom
Your ISP connects you to the rest of the internet. It in turn connects to other networks in two main ways:
- Transit: a smaller network pays a larger one to carry its traffic to the rest of the internet.
- Peering: two networks exchange traffic directly with each other, often at no charge, usually at an internet exchange point (IXP) or through a private link.
Large content and cloud providers often peer directly with consumer ISPs, which shortens the path and removes hops. Where there is no direct link, traffic may pass through one or more transit networks, adding distance and delay. Neither you nor the website controls this fully, which is one reason why latency to the same server can differ between ISPs in the same city.
Physical infrastructure: cables, data centres and edges
Under the protocols is hardware. Most long-distance traffic travels as pulses of light in optical fibre. Light in glass moves at roughly 200,000 km/s, about two thirds of its speed in a vacuum, which gives about 5 microseconds per kilometre one way, or roughly 1 ms of round-trip time per 100 km of fibre. Between continents, the large majority of traffic crosses the oceans in submarine cables, as explained in undersea cables and the speed of light. Satellites, including low-orbit constellations, handle a much smaller share of global traffic but matter for remote areas, ships and aircraft.
At the other end of the path, content is stored in data centres. Big services run many of them in different regions, and use content delivery networks to keep copies of popular files closer to users. This is why a popular site may answer from a server a few hundred kilometres away while a small site hosted in one location answers from across an ocean. See data centres, cloud regions and edge and CDN and anycast.
The last stretch to you, the access network, may be fibre, cable, DSL, a mobile network, Wi-Fi or satellite. It often contributes a few milliseconds on wired links and more on wireless ones.
What happens when you open a web page?
Here is the complete sequence for visiting https://example.com/ from a fresh start:
- DNS lookup. Your device asks a DNS resolver (usually run by your ISP or a public provider) for the IP address of
example.com. If the answer is cached, this is nearly instant. - TCP handshake. Your device sends a SYN packet to the server's address, the server answers, and your device confirms. This takes one round trip.
- TLS handshake. The two sides agree on encryption and the server proves its identity with a certificate. With TLS 1.3 this normally takes one additional round trip. Details are in the TLS and HTTPS handshake guide.
- HTTP request. The browser sends a request for the page. The server processes it and starts sending the response.
- More requests. The page references images, scripts, styles and data from the same or other servers, each of which may need its own DNS lookup and connection. Newer protocols reduce the repeated cost, see HTTP/1.1, HTTP/2, HTTP/3 and QUIC.
Each numbered step that needs a reply costs at least one round-trip time (RTT) of waiting. That is why the RTT to the server is multiplied several times before the first byte of content shows on screen, and why latency matters much more to page loading than raw bandwidth for small files.
Worked example: tracing 3 ms, 20 ms and 150 ms
Example 1: A request to a server in your own city
You are on fibre, connected by Ethernet. The path is your device, home router, ISP network, local exchange, and a data centre in the same city, about 10 hops and perhaps 30 km of fibre. Propagation is about 0.3 ms round trip, and each of the ten routers adds tens of microseconds, plus a few milliseconds of access and server-side queuing. A measured round trip of about 5 to 12 ms is normal.
Example 2: A request across a continent
Now the server is about 4,000 km away in a straight line. A real fibre path is often 20 to 50 percent longer than the straight line, say 5,500 km. One-way propagation is 27.5 ms, so the round trip is 55 ms before anything else is added. With access and equipment delay of about 10 ms, a measurement near 65 ms is what you should expect, and 100 ms would suggest a roundabout route or congestion.
Example 3: Counting round trips for a first page load
Take the 65 ms RTT from example 2. Uncached DNS through a nearby resolver might take 15 ms. TCP takes 65 ms, TLS 1.3 takes 65 ms and the HTTP request takes 65 ms plus, say, 50 ms of server processing. The first byte arrives after about 15 + 65 + 65 + 65 + 50 = 260 ms. If the same content were served from a CDN node 10 ms away, the network part would shrink to roughly 15 + 10 + 10 + 10 = 45 ms, and with the same 50 ms of processing the first byte would arrive in about 95 ms.
Where does the delay come from?
| Source | What it is | Typical size |
|---|---|---|
| Propagation | Light travelling through fibre | About 1 ms RTT per 100 km of fibre path |
| Access network | Wi-Fi, cable, mobile, DSL, fibre to the home | Under 1 ms (Ethernet) up to tens of ms (mobile, satellite) |
| Routing detours | Paths longer than the straight line | Often 20 to 100 percent extra distance |
| Queuing | Waiting in buffers on busy links | 0 ms when idle, hundreds of ms when saturated |
| Handshakes | DNS, TCP and TLS before any content | One or more RTTs each |
| Server time | Generating the response | Few ms for static files, much more for heavy pages |
How can you see this on your own connection?
You can watch the internet's behaviour from your own device. ping shows round-trip times to a host, and traceroute (tracert on Windows) lists the routers on the way and the delay at each. A browser tool can also show the effect of distance: the free GlobeLatency test measures HTTPS round trips from your device to public servers around the world, and you will see low numbers for nearby destinations and steadily higher ones as distance grows. The live map shows the same measurements continuously. Because these are real HTTPS requests, they include DNS, TCP and TLS setup when a new connection is made, so they read a little higher than raw ICMP ping.
Common mistakes and myths
- "The internet is in the cloud." It is physical: cables, radios, routers and buildings full of servers. "The cloud" just means someone else's data centres.
- "Faster internet means every site loads faster." Bandwidth helps with large downloads. Small requests are dominated by latency and number of round trips, which a faster plan does not shorten.
- "Packets always take the shortest route." They follow routing policy, which depends on commercial agreements and can produce detours. The forward and return paths can differ too.
- "Wi-Fi problems are internet problems." The first hop is often the weakest. Compare a wired and a wireless test before blaming the provider.
- "If a site is slow, my connection is slow." The slowdown may be at the server, in a far-away data centre or on a congested route in between.
- "A traceroute hop with high delay is the problem." Routers often deprioritise replies to probes, so one slow hop in the middle that does not continue to later hops is usually harmless.
What to do next
Now that you know the path a packet takes, learn how names become addresses in DNS explained and how reliable delivery is built on top of packets in TCP and UDP explained. To put numbers on your own connection, run the free latency test and read what is latency to interpret what you see. If you want to know how the networks choose paths, continue with routing, BGP and peering.
Frequently asked questions
Who owns the internet?
Nobody owns the whole internet. It is a network of tens of thousands of separately owned networks: internet service providers, universities, companies, content providers and governments. They connect by agreement. Shared standards are written by bodies such as the IETF, and address and domain-name coordination is handled by organisations such as IANA, ICANN and the regional internet registries, but none of them operates or controls the network itself.
What is the difference between the internet and the web?
The internet is the global network infrastructure that carries data between devices. The web is one service that runs on top of it: web pages and web apps fetched with HTTP and HTTPS by browsers. Email, online games, video calls, file transfers and messaging apps also use the internet but are not the web.
What is a packet?
A packet is a small unit of data, typically up to about 1,500 bytes on most Ethernet-based networks, that carries a header (source and destination addresses and other control information) and a piece of the payload. Larger messages such as web pages or video are split into many packets, sent independently, and reassembled by the receiver.
How does data travel across the ocean?
Mostly through submarine fibre-optic cables lying on the seabed, which carry the large majority of intercontinental traffic. Light pulses travel through glass fibre at roughly 200,000 km/s. Satellites carry only a small share of global traffic. Crossing an ocean adds tens of milliseconds of unavoidable delay because of distance.
Why does the same website load faster for some people than others?
Because the path differs. Distance to the server, the number of networks crossed, congestion, the type of access connection and whether the site uses a content delivery network all change the round-trip time and the number of round trips needed. Two people in different cities can have very different experiences with the same site.
What happens if one router or cable fails?
Traffic usually takes another path. Routers exchange reachability information and recalculate routes within seconds to minutes when a link fails, so most failures are invisible apart from a brief slowdown or a few lost packets. The alternative route is often longer, so latency can rise until the original path returns.
Is the internet the same as Wi-Fi?
No. Wi-Fi is a wireless way to connect your device to a local network, usually your home router. The internet starts beyond that router, at your internet service provider. A Wi-Fi network works without internet access, and the internet is reachable over many other media, including cables, fibre, mobile and satellite.