Slow TTFB is the most reported and least diagnosed symptom in web performance, because first byte is a sum wearing a single number’s clothes. The waterfall decomposes the sum, and a fixed reading order converts mystery into method.
The six segments, in reading order
Every request timeline splits into: DNS resolution, TCP (or QUIC) connect, TLS handshake, request send, server wait (the true time-to-first-byte-of-response), and content download. Modern devtools and Resource Timing expose each. The discipline is reading them in order and attributing before theorizing: each segment implicates a different layer, and the layer tells you whose dashboard to open next.
What each segment indicts
Long DNS: resolver distance, uncached names, CNAME chain depth. Long connect: geographic distance to the serving POP, catchment misrouting (our anycast article), or packet loss stretching the handshake. Long TLS: full handshakes where resumption should apply, chain bloat, OCSP misadventures. Long server wait on a cache hit: edge under duress or misclassified hit; on a miss: origin distance plus origin think time, decomposable further with server-timing. Long download: throughput and congestion territory, our BBR article’s jurisdiction.
A worked example, composited from real engagements: checkout TTFB p95 regressed 400ms with no deploy anywhere. Segment read: DNS flat, connect flat, TLS flat, server-wait up exactly on cache misses, hit-path untouched. Layer attribution: origin path. Server-timing decomposition: origin think-time flat, but shield-to-origin connect time up. Owner: network path between shield and origin, where a routing change had added a continent to the miss path. Total diagnosis time with the method: under an hour, most of it confirming. The same incident without segment discipline historically generates days of application profiling, because the sum pointed everywhere and the segments pointed home.
The comparative method
Single waterfalls mislead; pairs diagnose. Same URL, hit versus miss (fingerprint the difference: that is your miss penalty). Same page, near POP versus far (that is geography’s share). Same asset, cold connection versus warm (handshake tax). Instrument these comparisons in RUM cohorts and the one-off debugging session becomes a standing dashboard that pre-answers the next incident’s first hour.
In practice
Codify it as a runbook: symptom, segment read, layer attribution, owner. Teams with the runbook resolve delivery incidents in minutes because they skip the theorizing phase entirely; teams without it hold opinions in a meeting. And feed every diagnosis back into the standing cohort dashboards, so each incident permanently narrows the search space of the next one.
The runbook and cohort dashboards are deliverables in our observability engagements. Incidents shrink to queries.