Engrain by ByteRush

WEB.12.02 Mid-level· 11 minCore — asked often

TCP, TLS and connection setup: the round trips before your first byte

Count the round trips before a request: the TCP handshake, the TLS 1.3 handshake and 0-RTT resumption with its replay risk, certificate chains, HSTS, and head-of-line blocking.

Comes up in: Web fundamentals, Backend design

Learn#

Sunita’s site loads in 0.4 seconds in Bengaluru, near the server, and 2 seconds in Guwahati, though the page is small. The difference is not bandwidth; it is round trips.

A round trip (RTT) is the time for a message to reach the server and a reply to come back. Before a request, the client needs a handshake or two. TCP takes one round trip: SYN, SYN-ACK, then data.

TLS encrypts the connection. TLS 1.3 needs one more round trip: the client sends its key share in the first message, so the server can answer with everything at once. TLS 1.2 needed two.

Round trips before the first byteStep 1 of 4

Network

  • DNS lookup 40 ms

A phone in Patna opens a site hosted in Mumbai. One round trip takes 100 ms. First, DNS: 40 ms.

Read the steps as text
  1. A phone in Patna opens a site hosted in Mumbai. One round trip takes 100 ms. First, DNS: 40 ms.
  2. TCP handshake: SYN, then SYN-ACK. One round trip, 100 ms, before any data can flow.
  3. TLS 1.3: ClientHello with a key share, then ServerHello, certificate and Finished. One more round trip.
  4. Only now is the GET sent. Its response takes another round trip, so the first byte arrives after 340 ms.

During TLS, the server sends its certificate and the intermediate certificates that link it to a root the device trusts. A missing intermediate breaks some devices but not others.

Predict#

Predict first

TLS 1.3 0-RTT lets a returning client send its request in the first flight. What is the risk?

Interview angle#

Say it like this — about 30 seconds

“First the client resolves DNS, then TCP takes one round trip with SYN and SYN-ACK. In TLS 1.3, the client sends a ClientHello with its key share. The server replies with its key share, certificate chain and a signature, and both sides derive keys, so encrypted data starts after one round trip, versus two in TLS 1.2. A resumed session can use 0-RTT, but early data can be replayed. HTTP/3 over QUIC combines transport and TLS into one round trip.”

Stays on your device. Nothing is uploaded.
Follow-up Describe a TLS handshake at a high level.
Client hello with supported ciphers and a key share; server hello with its key share, certificate and proof; both derive session keys; encrypted traffic begins.
Follow-up What does HSTS do?
It tells the browser to use only HTTPS for the site for a set time, so the first request never goes over plain HTTP.
Follow-up How do you cut connection time for third-party origins?
preconnect hints, fewer origins, HTTP/2 or HTTP/3 connection reuse, and a CDN close to users.

Practice#

Guided

Count the round trips for different connection setups and turn them into time to first byte.

Done when

  • TCP with TLS 1.2, TLS 1.3 and no TLS give 4, 3 and 2 round trips plus DNS.
  • QUIC costs 2 round trips, or 1 with 0-RTT.
  • 0-RTT over TCP still pays for the TCP handshake.
Your solution
Ctrl/⌘ + Enter

Remember#

Try to answer each card before you open it. Then add them to your reviews.

How many round trips does the TCP handshake take?

One (SYN, SYN-ACK).

How many round trips does a new TLS 1.3 handshake add?

One (TLS 1.2 added two).

What is the risk of TLS 0-RTT?

Early data can be replayed, so it must be safe to repeat.

What does HSTS do?

Forces HTTPS for the site for a set time.

Go deeper

Four layers. Stop at the one your interview needs; each ends with a quick check.

The core ideaEvery round

For small resources, round trips dominate, and each one costs at least the distance divided by light speed in fibre. A CDN edge near users shortens every round trip.

Check yourself: Why does distance matter more than bandwidth for small pages?

Small pages are bound by round trips, which depend on distance.

How it works underneathSenior rounds

TLS 1.3 saves a round trip by guessing: the ClientHello includes a key share for a likely group, so the server can finish the key exchange in its first reply .

Check yourself: What does the client send in the TLS 1.3 ClientHello that saves a round trip?

A key share, guessing the server's key-exchange group.

Edge cases and trapsWhere people slip
TCP delivers bytes in order. If one packet is lost, everything after it waits for the resend, even data for other HTTP/2 streams. QUIC fixes this per stream (WEB.12.03).
Check yourself: What is TCP head-of-line blocking?

One lost packet stalls all later data on the connection until it is resent.

In productionStaff-level answers

HSTS (Strict-Transport-Security: max-age=63072000; includeSubDomains; preload) makes browsers skip plain HTTP. The preload list covers even the first visit .
DevTools’ Timing tab shows DNS, connection and SSL times per request.

Check yourself: Why submit a site to the HSTS preload list?

So browsers use HTTPS even on the very first visit.

Finished the five steps? Mark it, and its cards join your reviews.

Last checked 2026-11-01. Spot a mistake? Use “Report an error” below — fixes are listed on the corrections page.

Interview questions this answers

  • Describe a TLS handshake at a high level.