Rerformance Investigation

How to Read a Network Waterfall for Web Performance Diagnosis

September 15, 2026 webperflab_admin 13 min read

Performance Investigation

A network waterfall shows when each resource was requested, how long the browser waited, and when the response finished loading. But the most useful question is not simply “Which request is biggest?”

The useful question is: Where in the request path did the delay occur, and what should you investigate next?

A waterfall is diagnostic evidence. It can reveal late request starts, long waits for the first response byte, slow transfers, dependency chains and third-party activity. It cannot, by itself, prove why JavaScript execution is expensive or why rendering remains blocked after network activity completes.

How do you read a network waterfall?

Start with the document request, then examine when critical resources begin, how long they wait for a response, how long they take to download, and what initiated them. A waterfall helps identify late discovery, slow server response, long transfers and dependency chains, but browser CPU and rendering problems require additional evidence such as a Performance Trace.

What a Network Waterfall Actually Shows

A network waterfall is a timeline of browser requests.

The horizontal axis represents time.

Each row represents a request made while the page loads or runs.

Depending on the request, the browser may spend time:

  • waiting before the request can be sent;
  • resolving a hostname;
  • establishing a connection;
  • sending the request;
  • waiting for the first response byte;
  • downloading the response body.
VISUAL 1 — Annotated Network Waterfall

Document → Waiting (TTFB) → Content Download
CSS / JS → request start → waiting → download
Critical image → start time → initiator → completion
Third party → domain → timing → overlap

A waterfall shows timing and relationships. It does not automatically explain causation.

Use it as part of a broader root-cause performance investigation.

Start With the Document Request

The document request is the first reference point for most page-load investigations.

Find the main HTML request and ask:

When did navigation begin?
When did the first response byte arrive?
How long did the HTML response take to download?
Did subresources begin early or only after the document progressed?

If the document spends a long time in Waiting (TTFB), every parser-discovered resource starts from a later baseline.

If the document responds quickly but a critical image or stylesheet begins much later, the investigation shifts toward discovery or dependency timing.

Start from the document, then move outward to the subresources that matter to the user-visible critical path.

Understand the Timing Stages of a Request

Chrome DevTools can show a timing breakdown for individual requests. Not every request displays every phase because connection reuse, cache state, Service Workers and protocol behavior can change the request path.

Queueing and stalled time

Queueing occurs before connection start when the browser delays a request—for example because higher-priority requests exist, connection availability is constrained, or other browser scheduling conditions apply.

Stalled can occur after connection start for similar scheduling or connection-related reasons.

Do not convert a long queueing value directly into a root-cause conclusion. First ask whether the request is critical and what else is competing for resources.

DNS, connection and TLS

A request to a new origin may require work before HTTP data can flow.

Relevant phases can include:

  • DNS Lookup — resolving the hostname;
  • Initial connection — establishing the connection, including connection handshake behavior and SSL negotiation;
  • proxy negotiation where relevant.

If an existing connection can be reused, some of these stages may not appear again.

Request sent

This is the period in which the request is being sent.

For typical page resources, this is often small compared with waiting or content download, but request payloads and connection conditions can change that.

Waiting for the response

Chrome labels this phase Waiting (TTFB).

The browser is waiting for the first byte of the response.

This timing can reflect both round-trip latency and the time required for the server or upstream path to prepare the response.

Long Waiting (TTFB) does not automatically prove “slow hosting.” Network latency, cache state, origin processing, application work and upstream dependencies may all require investigation.

For WordPress-specific server-response diagnosis, see diagnose high WordPress TTFB.

Content download

Content Download is the time spent receiving the response body.

A long download can point toward several directions:

  • large transfer size;
  • limited throughput;
  • slow network conditions;
  • origin or CDN delivery constraints;
  • the browser being busy enough to delay reading the response.

Do not assume that file size alone explains the duration.

Request Start Time Matters as Much as Duration

A small, fast resource can still hurt user-visible performance if it starts too late.

This is especially important for critical assets such as:

  • LCP images;
  • critical stylesheets;
  • fonts required for visible text;
  • scripts or data needed before important UI can appear.

For each critical request, inspect both:

When did it start?

Late start time can point toward discovery, dependency, scheduling or application timing.

How long did it take?

Long duration can point toward waiting, transfer, connection or delivery behavior.

A resource that takes 100 ms to download can still be late if the browser does not discover it until two seconds into the page load.

This is the bridge between waterfall analysis and late LCP discovery.

How to Spot Late Resource Discovery

Ask:

When did the browser learn about this resource?

Compare the request start time with the document timeline.

VISUAL 2 — Late Discovery Example

HTML → JavaScript → component or state change → critical image request

Possible discovery paths include:

  • HTML → image;
  • HTML → stylesheet → background image;
  • HTML → JavaScript → component → image;
  • HTML → JavaScript → API → UI resource;
  • HTML → tag manager → third-party resource.

The waterfall can show that a request begins late.

It usually cannot, by itself, explain exactly why that request began at that moment.

That is where the initiator becomes important.

Use the Request Initiator to Understand Why a Request Started Late

The Network panel’s request initiator information helps explain what caused a request.

Chrome can identify initiators such as:

  • the HTML parser;
  • a redirect;
  • JavaScript;
  • other browser or navigation activity.

The Initiator tab can also expose a request initiator chain.

When a critical request starts late, inspect the initiator before assuming the resource itself is the problem.

Observation: critical image starts late.
Next question: what initiated it?
Possible finding: the image cannot be requested until JavaScript creates the component that references it.

How to Read Resource Dependency Chains

Resources often depend on earlier resources or application work.

For example:

Stylesheet path

HTML → CSS → font

Client-rendered path

HTML → JS → API → component asset

Every dependency can move a user-visible critical request later in the timeline.

Chrome DevTools can show initiators and dependencies for a request, which helps reveal these relationships.

Do not assume every dependency chain is inherently bad.

The important question is whether it delays something that matters to the user-visible critical path.

Parallel vs Serial Loading

Waterfalls make request overlap visible.

Parallel loading

Multiple requests overlap in time.

Serial loading

One request starts only after another request or dependency reaches a certain point.

Serial behavior is not automatically a performance problem.

It becomes important when the serialized dependency controls:

  • critical content;
  • LCP resource discovery;
  • rendering;
  • important user-facing UI.

Do not optimize for maximum parallelism as an end in itself. Optimize the user-visible critical path.

How to Find the LCP Resource in a Waterfall

Start by identifying the LCP element.

If that LCP candidate uses a network resource, find the corresponding request in the waterfall.

Then inspect:

  • request start time;
  • initiator;
  • waiting time;
  • content download duration;
  • completion time.

This helps answer whether the LCP problem is associated with:

  • document response;
  • late discovery;
  • slow resource transfer;
  • or something that happens after the network resource is already available.

For the full routing framework, see diagnose slow LCP.

Pattern 1: High Document TTFB

Pattern:

The document request begins early but spends a large part of its duration in Waiting (TTFB) before HTML bytes arrive.

This tells you that the response path deserves investigation.

It does not prove:

  • the hosting is bad;
  • PHP is slow;
  • the database is slow;
  • the CDN is misconfigured.

Those are hypotheses that require additional evidence.

Pattern 2: Critical Resource Starts Too Late

Pattern:

The document responds, but an important image, font, stylesheet or script does not begin until much later.

This points toward discovery, dependency or scheduling.

The next steps are typically:

  1. inspect the request start time;
  2. inspect the initiator;
  3. inspect the dependency chain;
  4. determine whether the resource is on the user-visible critical path.

For LCP-specific cases, see late LCP discovery.

Pattern 3: Resource Downloads Too Slowly

Pattern:

The request starts at a reasonable time, waiting is not dominant, but Content Download remains long.

Possible investigation directions include:

  • resource transfer size;
  • compression;
  • connection throughput;
  • origin or CDN delivery;
  • responsive resource selection;
  • network conditions.

This is a transfer problem hypothesis—not an automatic image-format recommendation.

Pattern 4: Third-Party Requests Dominate the Network

Third-party activity can be visible as:

  • many external domains;
  • requests initiated by tags or scripts;
  • late dependency chains;
  • overlapping analytics, advertising, chat or embedded-media requests.

The waterfall can show network cost and request relationships.

It does not show the full CPU execution cost of third-party JavaScript.

A script that downloads quickly can still execute for a long time on the main thread.

When the Waterfall Looks Fine but the Page Is Still Slow

Sometimes the important requests appear to complete quickly, but the page still feels slow.

Possible directions include:

  • long JavaScript tasks;
  • style calculation;
  • layout;
  • rendering work;
  • client-side execution;
  • interaction processing.
VISUAL 3 — Network vs CPU

Network requests complete → main thread remains busy → visible content or interaction is still delayed

This is the point where a waterfall has reached its limit.

Use a Performance Trace and consider the network vs CPU bottleneck distinction.

Network Cost vs CPU Cost

Question Waterfall can help? Performance Trace may be needed?
When did the request start? Yes Usually not
How long did it wait for response? Yes Usually not
How long did download take? Yes Usually not
What initiated the request? Yes, with Initiator evidence Sometimes
How long did JavaScript execute? No, not sufficiently Yes
Was the main thread blocked? No Yes
Did style/layout delay paint? No Yes

Cache Signals Change the Waterfall

A request may come from:

  • memory cache;
  • disk cache;
  • a Service Worker;
  • CDN or edge cache;
  • the network or origin.

Different cache states can produce very different waterfalls.

A repeat visit with warm browser cache should not be treated as equivalent to a first visit with cold cache.

First Load vs Repeat Load

Always establish which state you are observing.

First load may include:

  • connection setup;
  • DNS;
  • cold browser cache;
  • first-time third-party requests;
  • uncached resource transfer.

Repeat load may reuse:

  • connections;
  • browser cache;
  • Service Worker responses;
  • other cached resources.

Use a defined performance baseline so comparisons remain meaningful.

Mobile vs Desktop Waterfalls Can Differ

Desktop waterfall behavior does not automatically represent mobile.

Differences can come from:

  • network profile;
  • device behavior;
  • responsive images;
  • conditional resources;
  • script behavior;
  • different viewport-driven application paths.

When mobile experience is the issue, reproduce and inspect the relevant mobile condition rather than relying on a desktop-only waterfall.

Use Filtering and Sorting to Answer a Question

The Network panel lets you filter resource types such as:

  • document;
  • CSS;
  • JavaScript;
  • images;
  • fonts;
  • Fetch/XHR.

You can also inspect specific domains or sort the waterfall by start time, response time, end time, total duration or latency.

Use filters and sorting to test a hypothesis—not merely because the tool has those controls.

Examples:

  • Which image requests start latest?
  • Which requests spend the longest time waiting?
  • Which third-party domain creates the most request activity?
  • Which resources finish after the user-visible critical content should already have appeared?

Diagnostic Questions to Ask When Reading a Waterfall

When did the document respond?

Start with the HTML response path.

Which critical resources started late?

Compare request start time with the document timeline.

Why did they start late?

Inspect initiator and dependencies.

Which requests took the longest?

Separate long waiting from long downloading.

Was time spent waiting or downloading?

The distinction changes the next investigation.

Are resources loading in parallel or serially?

Look for dependencies on the user-visible critical path.

Which third-party domains are involved?

Separate first-party and external request paths.

Which requests are actually user-critical?

Not every late request matters to initial experience.

Is the network really the bottleneck?

If requests finish but the page stays slow, inspect browser CPU and rendering.

What evidence do you need next?

Route to initiator, trace, server or application evidence.

Waterfall Pattern → Meaning → Limitation → Next Step

Waterfall pattern What it tells you What it does NOT prove Next step
Document waits a long time The response path is consuming time before first byte Bad hosting TTFB / cache / origin investigation
Critical image starts late Discovery or scheduling is late The image is too large Initiator and dependency investigation
Request starts early but downloads slowly Transfer duration is high Which exact delivery layer is responsible Size / network / CDN / throughput evidence
JavaScript downloads quickly Network transfer is relatively fast JavaScript is cheap to execute Performance Trace
Many third-party requests overlap External network activity exists Third-party CPU impact or business necessity Trace and dependency analysis

Request Stage → Diagnostic Meaning → Next Question

Request stage Diagnostic meaning Typical next question
Queueing / Stalled The request waited before or around connection use Was a higher-priority or connection-related constraint involved?
DNS Lookup Hostname resolution work occurred Was this a new origin or reusable connection path?
Initial connection Connection establishment occurred Is connection setup materially affecting critical requests?
Waiting (TTFB) Time before first response byte Network latency, cache, origin or upstream delay?
Content Download Time spent receiving response body Resource size, throughput or browser-read delay?
Late start The browser did not begin the request until later Who initiated it and what dependency came first?

A Practical Waterfall Diagnostic Decision Tree

VISUAL 4 — Waterfall Decision Tree

Document → Critical start time → Waiting → Download → Initiator → CPU / Rendering

IS THE DOCUMENT RESPONSE LATE?
│
├─ YES
│  └─ Investigate TTFB → cache → origin → server / application
│
└─ NO
   ↓
DOES A CRITICAL RESOURCE START LATE?
│
├─ YES
│  └─ Check discovery → initiator → dependency chain
│
└─ NO
   ↓
DOES THE RESOURCE TAKE LONG TO DOWNLOAD?
│
├─ YES
│  └─ Investigate transfer size → network → CDN → throughput
│
└─ NO
   ↓
IS THE PAGE STILL SLOW AFTER RESOURCES COMPLETE?
│
├─ YES
│  └─ Use Performance Trace → CPU → main thread → rendering
│
└─ NO
   └─ Continue dependency / critical-path analysis

Common Network Waterfall Reading Mistakes

Only looking for the largest request

Late start time can matter more than size.

Only looking at total load time

Total completion does not explain the critical path.

Not starting with the document

Subresource timing needs a document baseline.

Ignoring request start time

A fast request can still begin too late.

Confusing waiting with downloading

They point toward different investigation directions.

Blaming hosting from high TTFB

Waiting does not identify the responsible backend layer.

Blaming a large image for LCP

The image may not be the LCP candidate or may be discovered late.

Ignoring the initiator

Late requests often require initiator evidence.

Mixing first and repeat load

Cache and connection states can differ substantially.

Ignoring third-party domains

External dependencies can alter network timing and discovery.

Using waterfall to prove CPU bottlenecks

Network timing does not show full JavaScript execution or rendering cost.

Not identifying the actual LCP element

The visually largest image is not automatically LCP.

Testing only desktop

Mobile can request different resources under different conditions.

Testing only once

One waterfall may contain cache or network noise.

No baseline

Without comparable conditions, before/after interpretation becomes weak.

What a Network Waterfall Cannot Tell You

A waterfall is powerful, but its scope is limited.

It does not fully explain:

JavaScript execution cost
Long tasks
Style recalculation
Layout cost
Rendering cost
Interaction delay
Full application root cause
Server internals without server evidence

If the network looks healthy but the page remains slow, continue with a Performance Trace.

If the document response is slow, continue with server or application evidence.

If a request begins late, continue with initiator and dependency evidence.

What Evidence Should You Inspect Next?

Waterfall shows the delay, but the root cause is still unclear?

A network waterfall is often the fastest way to see where loading time is being spent, but it is only one layer of the investigation. When the waterfall reveals a late dependency, slow origin response or unexplained timing gap, a structured web performance investigation can connect network evidence with initiators, browser traces and server evidence before production changes are made.

WebPerfLab — Measure → Trace → Diagnose → Fix → Verify

Final Takeaway

Start with:

  • the document request;
  • critical request start time;
  • Waiting (TTFB);
  • Content Download;
  • the request initiator;
  • dependency relationships.

Then determine whether the bottleneck is:

  • network;
  • delivery;
  • resource discovery;
  • or somewhere outside the network entirely.
Observe→
Compare→
Trace→
Hypothesize→
Confirm→
Investigate deeper

A waterfall is evidence. Root-cause diagnosis requires the next layer of proof.