Networking Basics

Before a single line of your handler executes, four things had to happen: the name resolved to an address, a TCP connection opened, a TLS session negotiated, and the HTTP request crossed the wire. Each is a round trip or more. On a fresh connection to a distant server, you can spend 300ms on setup before the server even sees the request.

Knowing where that time goes is the point. Most front-end latency wins come from cutting round trips out of this path, not from faster application code.

DNS turns example.com into an IP. A recursive resolver (usually your ISP's or something like 8.8.8.8) does the legwork, walking from the root to the authoritative nameserver that actually owns the record, then caching the answer for its TTL. Most lookups never leave the resolver's cache.

DNS is also a load-balancing and routing tool. Return multiple A records and clients spread across them. Return different answers based on the resolver's location — GeoDNS — and you send each user to their nearest region.

TCP gives you a reliable, ordered byte stream: it handshakes to open a connection, acknowledges every segment, retransmits losses, and slows down under congestion. All of that costs round trips and head-of-line blocking — a lost packet stalls everything behind it until it's resent.

UDP gives you none of it. Fire a datagram and hope. No handshake, no ordering, no retransmit. That's a feature when late data is useless: in a video call, a dropped frame should be skipped, not resent stale.

The through-line across HTTP versions is a war on round trips and head-of-line blocking. Each version removed a place where requests had to wait in line.

TLS encrypts the connection and proves the server's identity via a certificate. The cost is the handshake: one extra round trip in TLS 1.3, two in the older TLS 1.2. On a cold connection that's added latency on top of TCP setup.

Two mitigations matter. Session resumption lets a returning client skip the full handshake with a cached key — even 0-RTT, sending data on the first packet. And TLS termination at the load balancer means the expensive crypto happens once at the edge, not on every app server.

Terminating TLS at the edge simplifies certificate management and offloads CPU, but it means traffic inside your network is plaintext by default. Whether that's acceptable depends on your trust model — a zero-trust design re-encrypts internally with mTLS (Security Basics).

A CDN is a fleet of edge servers (PoPs) spread across the globe, each caching copies of your content. The user hits the nearest edge instead of your origin, cutting latency and offloading traffic. For static and cacheable content, this is the single biggest delivery win available — and the dominant cost line for anything media-heavy (Video Streaming).

Put on a CDN what's static or reusable across users: images, video, CSS/JS, fonts, and cacheable API responses. Keep off it anything per-user or sensitive unless you gate access. For private content, signed URLs grant time-limited access to a specific object without making it public — the same mechanism that lets clients pull a paywalled video segment straight from the edge.