Compare layer 4 and layer 7 load balancing. When is each the right choice?
Key points
- L4 balances on IP and port without reading the payload, so it is fast and protocol-agnosticIn plain words: The lower kind forwards by address and port without opening the message, so it is quick and works for any protocol
- L7 terminates the connection and routes on HTTP details such as path, host header or cookiesIn plain words: The higher kind opens the request and decides using the web address, the site name or cookies
- L7 enables content-based routing, TLS termination, compression and request-level observabilityIn plain words: Because it reads requests it can route by content, handle encryption, compress replies and report on every request
- L4 wins for raw throughput, non-HTTP protocols and when end-to-end encryption must be preservedIn plain words: The lower kind wins on raw speed, for traffic that is not web traffic, and when encryption must stay intact end to end
- Many real systems chain them, an L4 tier in front of L7 proxiesIn plain words: Many setups use both, the lower kind at the front feeding a row of the higher kind
Model answer
Layer 4 balancers work at the transport layer. They see source and destination IP and port, pick a backend, and forward packets (often with NAT or direct server return). Because they never parse the payload they are extremely fast, handle any TCP or UDP protocol, and can pass encrypted traffic straight through.
Layer 7 balancers terminate the client connection, parse the application protocol (usually HTTP), and open a new connection to a backend. That costs CPU but unlocks a lot:
- route
/api/*to one service and/static/*to another - send users with a
betacookie to a canary pool - terminate TLS once, then talk plaintext or re-encrypt inside the network
- add retries, timeouts, header rewriting, compression, rate limiting and per-route metrics
Choosing
| Need | Pick |
|---|---|
| Millions of connections, gaming, DNS, raw TCP | L4 |
| Path or host based routing, canaries, auth at the edge | L7 |
| Must not decrypt in the middle | L4 (or L7 with SNI-only routing) |
| Rich request-level observability | L7 |
In practice large systems stack them: an L4 tier (anycast or ECMP) spreads traffic across a fleet of L7 proxies, which then do the smart routing.
Likely follow-ups
- Where does WebSocket traffic fit, and what does an L7 balancer need to support it?
- How does TLS termination at L7 affect your security story?