Walk me through what happens, at the network level, when a .NET client calls https://api.example.com/orders/42 and gets a response.

1. The layers involved

Layer (TCP/IP model)   What it does here                   .NET / tooling
───────────────────────────────────────────────────────────────────────────
Application            HTTP request/response, DNS          HttpClient, Dns.GetHostAddressesAsync
Security               TLS encryption, certificate check   SslStream (inside SocketsHttpHandler)
Transport              TCP (or UDP for HTTP/3), ports      Socket
Internet               IP addresses, routing               IPAddress, ping, traceroute
Link                   Ethernet/Wi-Fi frames, MAC          (OS and NIC)

2. DNS

The OS resolver checks its cache and hosts file, then asks the configured DNS server, which may recurse through root, .com and example.com name servers. The answer has a TTL. .NET asks the OS (getaddrinfo); it does not keep its own DNS cache.

3. Routing and NAT

Your machine sends packets to its default gateway. Home and cloud networks usually NAT private addresses (e.g. 10.x) to a public IP. Each router hop forwards based on the destination IP. traceroute / tracert shows the hops.

4. TCP and ports

The client picks an ephemeral source port (e.g. 51544) and connects to 443. The connection is identified by the 4-tuple (client IP, client port, server IP, 443). TCP guarantees ordered, reliable delivery and controls the sending rate.

5. TLS

The client sends the hostname in SNI so a load balancer hosting many sites can pick the right certificate, and lists protocols in ALPN (h2, http/1.1). It validates the certificate chain to a trusted root and checks the name matches.

6. HTTP and the edge

Often the request passes through a CDN or WAF, then a load balancer or ingress controller that terminates TLS and forwards plain HTTP (or re-encrypted HTTPS) to a pod. Headers like X-Forwarded-For and X-Forwarded-Proto carry the original client details.

7. Seeing it from .NET

SocketsHttpHandler publishes metrics (System.Net.Http, System.Net.NameResolution, System.Net.Sockets) including DNS lookup duration, connection setup time and open connections. View with:

dotnet-counters monitor -n MyApp --counters System.Net.Http,System.Net.NameResolution

OpenTelemetry's HTTP client instrumentation also records these as spans and metrics.

8. Try it yourself

1. curl -w "dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} total:%{time_total}\n" -o /dev/null -s https://example.com
2. Run it twice with --http2 and compare.
3. dig example.com and traceroute example.com (or tracert).
4. In .NET, call the same URL 5 times with one HttpClient and print Stopwatch times; the first call is slowest.

// Measure where time goes for one request (cold vs warm) using HttpClient events
using System.Diagnostics;

var handler = new SocketsHttpHandler
{
    PooledConnectionLifetime = TimeSpan.FromMinutes(2),
    ConnectCallback = async (ctx, ct) =>
    {
        var sw = Stopwatch.StartNew();
        var addresses = await Dns.GetHostAddressesAsync(ctx.DnsEndPoint.Host, ct);
        Console.WriteLine($"DNS {ctx.DnsEndPoint.Host} → {addresses[0]} in {sw.ElapsedMilliseconds} ms");

        sw.Restart();
        var socket = new Socket(SocketType.Stream, ProtocolType.Tcp) { NoDelay = true };
        await socket.ConnectAsync(addresses, ctx.DnsEndPoint.Port, ct);
        Console.WriteLine($"TCP connect in {sw.ElapsedMilliseconds} ms");
        return new NetworkStream(socket, ownsSocket: true); // TLS happens after this
    }
};

using var client = new HttpClient(handler);
for (int i = 0; i < 3; i++)
{
    var sw = Stopwatch.StartNew();
    using var response = await client.GetAsync("https://example.com/");
    Console.WriteLine($"Request {i + 1}: {(int)response.StatusCode} HTTP/{response.Version} in {sw.ElapsedMilliseconds} ms");
}
// Request 1 prints DNS + TCP lines and is slowest; requests 2 and 3 reuse the connection.

# Same breakdown from the command line
curl -so /dev/null -w "dns %{time_namelookup}s  tcp %{time_connect}s  tls %{time_appconnect}s  ttfb %{time_starttransfer}s  total %{time_total}s\n" https://example.com