A visual guide to how the Internet and the Web actually work — networking fundamentals, routing, DNS, transport, security, browsers, HTTP, web servers, caching, CDNs, and modern infrastructure. Built to form a coherent mental model rather than isolated facts: ideal for self-study, onboarding, revision, or certification prep.
Opens in the browser — no account, nothing to install. Yours to edit once it's open,
or download the file to keep.
Graphs are built for a large screen — open this one on a desktop computer.
You have typed a URL and pressed enter maybe a million times. Somewhere in the second and a half
that follows, a name becomes an address, an address becomes a route, a route becomes a
conversation between two machines that have never met, and a page appears. Most people who work
with the web for a living know each of those steps in isolation and have never once seen them
laid end to end.
That is what this map is for. It is built as a mental model rather than a glossary, so things
sit next to the thing that explains them: DNS beside the problem it solves, TLS on top of the
transport it protects, a CDN somewhere you can see the round trip it is cutting short. Nothing
here is a fact you could not look up. The value is in the arrangement.
Start wherever you already half-know something — for most people that is HTTP or the browser —
and work downward until the layer below stops feeling like a black box. If you are preparing for
an interview or a certification, the security and caching branches are where the questions
actually come from.
It stops at the level a working engineer needs. No frame formats, no routing policy, nothing
that belongs in an RFC rather than in your head. If you want to take it further, open it and
keep going — that is what it is there for.
What's in this graph
The map opens on Internet & the Web. These are the concepts branching from it — open one to
see the concepts inside it.
written article or notes
Internet Applications
An Internet application is a communication system that uses Internet services to perform a user-oriented or machine-oriented task.
7 children · 44 grandchildren · 8 neighbours
World Wide Web
The World Wide Web is a global hypertext application system in which clients access linked resources identified by Uniform Resource Locators using the Hypertext Transfer Protocol.
9 children: Browser, Web Delivery, HTTP, Web Resource, Client–Server Model …
50 grandchildren · 10 neighbours
Email
Email is a store-and-forward Internet messaging system that transfers messages between domains and provides mailbox access to recipients.
Instant messaging is a networked communication system for low-latency messages, presence, offline delivery, notifications, and multi-device synchronization.
Internetworking is the machinery that makes many separate networks behave as one Internet.
7 children · 39 grandchildren · 8 neighbours
IP Addressing
Internet Protocol addressing organizes interface locators into prefixes and subnets so routing can aggregate destinations rather than track every host individually.
5 children: IP Address, Address Scope, Subnet, CIDR, Network Prefix
12 grandchildren · 6 neighbours
Routing System
The routing system is the control plane that learns and selects reachability.
An Internet Protocol datagram is the independently forwarded data unit of the Internet layer.
9 children: ECN, DSCP, Fragmentation, Hop Limit, IPv4 Header …
3 grandchildren · 10 neighbours
Packet Forwarding
Packet forwarding is the data-plane process of matching a destination against forwarding entries, selecting a next hop, and transmitting the packet on an outgoing interface.
8 children: Routing Table, Default Route, Equal-Cost Multipath, Forwarding Information Base, Longest Prefix Match …
3 grandchildren · 9 neighbours
ICMP
The Internet Control Message Protocol carries Internet Protocol error reports, diagnostics, and control information.
Internet interconnection joins independently operated networks through peering, purchased transit, exchange points, and anycast announcements.
4 children: Anycast, Internet Exchange Point, IP Transit, Peering
4 grandchildren · 5 neighbours
Internet Protocol
The Internet Protocol defines the common internetwork layer used above many link technologies and below many transports.
3 children: Internet Layer Service, IPv4, IPv6
4 grandchildren · 4 neighbours
Domain Name System
The Domain Name System is the Internet's distributed naming system.
7 children · 38 grandchildren · 8 neighbours
DNS Records
Domain Name System records are typed resource records that store addresses, aliases, mail routing, authority, verification, and security data.
5 children: DNSSEC Records, Alias and Service Records, Address Records, Authority Records, Resource Record
13 grandchildren · 6 neighbours
DNS Resolver
A Domain Name System resolver is software that obtains resource-record answers for clients by consulting caches and authoritative servers.
5 children: DNS over HTTPS, Recursive Resolver, DNS over TLS, QNAME Minimization, Stub Resolver
10 grandchildren · 6 neighbours
DNS Namespace
The Domain Name System namespace is the hierarchical collection of domain names rooted at the global root label.
8 children: Domain Name, DNS Hierarchy, DNS Zone, Fully Qualified Domain Name, Registered Domain …
4 grandchildren · 9 neighbours
DNS Resolution
Domain Name System resolution is the process of obtaining resource-record answers by using caches and following delegations to authoritative servers.
4 children: DNS Message, Iterative Query, Recursive Query, Resolution Path
7 grandchildren · 5 neighbours
DNS Delegation
Domain Name System delegation assigns authority for a child zone to designated authoritative name servers and may extend a signed chain of trust.
6 children: Delegation, Authenticated Denial of Existence, Child Zone, Glue Record, Parent Zone …
3 grandchildren · 7 neighbours
Authoritative Name Server
An authoritative name server answers Domain Name System queries from zone data for which it has authority.
5 children: Primary Authoritative Server, Root Name Server, Secondary Authoritative Server, TLD Name Server, Zone Transfer
2 grandchildren · 6 neighbours
DNS Caching
Domain Name System caching stores resource-record answers for their permitted lifetimes to reduce latency and authoritative-server load.
5 children: DNS Cache Hit, DNS Cache Miss, DNS Cache Poisoning, DNS TTL, Negative Caching
1 grandchild · 6 neighbours
Internet Transport
Internet transport is the end-to-end communication service that gives applications usable conversations over the Internet Protocol.
6 children · 34 grandchildren · 7 neighbours
Reliability
Transport reliability detects loss or reordering and reconstructs the intended data stream through sequence information, acknowledgments, timers, retransmission, and recovery algorithms.
Congestion control adapts sending behavior to shared network capacity so flows can use available bandwidth without persistently overwhelming queues and links.
Quick UDP Internet Connections is a secure multiplexed transport protocol over User Datagram Protocol used notably by Hypertext Transfer Protocol version 3.
Infrastructure security protects routing, naming, network boundaries, and service capacity from spoofing, route hijacking, cache poisoning, and denial-of-service attacks.
Web security protects web applications, browser execution, user sessions, and Hypertext Transfer Protocol interactions from common attacks and unsafe content.
4 children: Web Attack Classes, Transport Security Policy, Content Security, Web Application Firewall
8 grandchildren · 5 neighbours
Identity and Trust
Identity and trust bind keys or credentials to entities and establish which issuers, roots, and verification procedures a participant is willing to rely on.
3 children: Server Authentication, Digital Identity, Trust Anchor
7 grandchildren · 4 neighbours
Threat Model
A threat model identifies the capabilities and objectives of possible attackers so security mechanisms can be evaluated against concrete risks rather than vague danger.
A set of architectural principles that guide how Internet protocols divide responsibilities, interoperate, and evolve.
7 children · 30 grandchildren · 8 neighbours
Best-Effort Delivery
Best-effort delivery means the Internet layer attempts to deliver datagrams but does not promise arrival, order, timing, or duplicate suppression.
4 children: No Duplicate Suppression, No Delivery Guarantee, No Ordering Guarantee, No Timing Guarantee
4 grandchildren · 5 neighbours
Decentralized Administration
Decentralized administration allows networks, service providers, standards bodies, and application operators to make local decisions while coordinating through shared protocols and agreements.
The end-to-end principle places functions that require application knowledge or complete correctness at the endpoints, while keeping the shared network core comparatively general.
Name–address separation distinguishes stable or human-meaningful identifiers from network locators and uses resolution plus indirection to connect the two.
Open standards publish protocol behavior and data formats so independently implemented systems can interoperate without a single vendor controlling the Internet.
4 children: Request for Comments, Interoperability, Internet Engineering Task Force, Rough Consensus and Running Code
4 grandchildren · 5 neighbours
Packet Switching
Packet switching divides communication into independently forwarded packets so many flows can share links dynamically instead of reserving an end-to-end circuit.
Network access covers the first part of a communication path: how a device exchanges frames on a local link, obtains configuration, reaches its first router, and connects through an access provider.
6 children · 27 grandchildren · 7 neighbours
First-Hop Router
The first-hop router is the device a host sends non-local traffic toward.
5 children: NAT, Carrier-Grade NAT, Default Gateway, Home Router, Port Address Translation
5 grandchildren · 6 neighbours
Link Layer
The link layer carries data across one local link.
6 children: ARP, Broadcast Domain, Frame, Link MTU, MAC Address …
3 grandchildren · 7 neighbours
Address Configuration
Address configuration is the process of giving a host addresses, prefixes, default routers, and often Domain Name System resolver information.
An access network connects the customer edge to an Internet service provider.
4 children: Cable Access, Cellular Access, Fiber Access, Internet Service Provider
5 neighbours
Ethernet
Ethernet is the dominant wired local-network technology.
4 children: MAC Learning, Network Switch, Spanning Tree Protocol, VLAN
5 neighbours
Wi-Fi
Wi-Fi provides link-layer connectivity over radio.
4 children: CSMA/CA, SSID, Wi-Fi Association, Wireless Access Point
5 neighbours
The shape of this map
A tree linking 629 ideas would need 628
connections. This map has 889. The extra 261 open alternative routes throughout.
The map runs 6 levels deep from its root. Any two ideas are about 6.2 steps apart, and the two most distant are 11.
Neighbouring ideas are linked to each other 21% of the time — themes hold together rather than radiating separately.
Connections are typed, not plain lines. They come in 4 kinds: Includes, Enables, Carries, Motivates.
Most routes through the map pass through Internet Applications, World Wide Web, Internetworking, Internet Security, Web Delivery, Domain Name System.
One node from the map
Internet & the Web
The Internet is one of the largest cooperative systems ever built. Billions of devices exchange data across fibre, copper, radio, satellite links, private networks, public carriers, cloud platforms, and home routers, yet the result usually appears as a single effortless action: a message arrives, a page opens, a call connects, or a file synchronizes. The machinery is almost invisible precisely because it works so well.
That apparent simplicity conceals an unusual engineering achievement. The Internet is not one network owned or operated by one authority. It is a federation of independently managed networks that agree on enough common rules to exchange traffic. A laptop on Wi-Fi, a mobile phone on a cellular network, a server in a data centre, and a sensor behind a satellite link can communicate without sharing the same hardware, local technology, or operator. The system succeeds by standardizing the boundaries between responsibilities rather than standardizing every component.
Understanding those boundaries is the key to understanding the subject. A local link carries data to a nearby device or router. The Internet Protocol provides a common packet format and addressing model across different networks. Routers forward packets hop by hop, while routing systems learn which destinations are reachable and under what policies. Transport protocols turn best-effort packet delivery into forms of communication useful to applications. Naming systems allow people and software to refer to services without memorizing numerical addresses. Security mechanisms establish confidentiality, integrity, identity, and trust across paths that may include unknown or untrusted networks. …
This continues inside the graph, along with 628 other nodes.
