Layer 4 vs layer 7 load balancing

A load balancer decides where each piece of traffic goes, and its decisions are only as smart as what it can see. The layer number comes from the OSI model, the seven-layer map of networking. Layer 4 is the transport layer: it sees IP addresses, ports, and TCP or UDP. Layer 7 is the application layer: it sees the HTTP request itself.

The big idea

Think of a mail sorting office. A layer 4 sorter reads only the outside of each envelope. It sends everything for one postcode to one van and never opens a letter. A layer 7 sorter opens every letter, reads "Invoice question" or "Password reset", and sends each one to the right desk.

The analogy breaks down because opening letters costs real work, which is the layer 7 trade-off.

Walking through it

A layer 4 balancer picks a backend when a TCP connection opens, then sends every packet on that connection to the same backend. A layer 7 proxy ends the client's connection, reads each HTTP request, and decides again for each one.

Layer 4 (one connection, pinned to 10.0.0.5):
  GET /api/orders    -> 10.0.0.5
  GET /static/a.css  -> 10.0.0.5    (same place, it can't tell them apart)

Layer 7 (the same two requests):
  GET /api/orders    -> orders service
  GET /static/a.css  -> static file pool

Layer 4 balancers run in two modes. In NAT mode the balancer rewrites addresses and sees both directions. In direct server return (DSR) mode, responses go straight from the backend to the client, which suits responses much bigger than requests. Google's Maglev paper describes a software layer 4 balancer built this way.

The common production setup stacks the two. A cheap layer 4 tier spreads TCP connections across a fleet of layer 7 proxies, and those proxies route each request to a service.

Common mistakes

• Expecting layer 4 to route by path. It never parses HTTP, so it can't send /api and /static to different pools.
• Putting gRPC behind a layer 4 balancer without expecting connection pinning.
• Ignoring what layer 7 costs. TLS and HTTP parsing use real CPU. Put the layer 7 tier where its logic is needed.

Check yourself

1. Why can't a layer 4 balancer send /api and /static to different pools?

   It never parses HTTP, so it can't see the path. It only sees IPs, ports and TCP.

2. Why can one gRPC backend run hot while the others sit idle behind a layer 4 balancer?

   All the gRPC requests share one long-lived TCP connection, and layer 4 pins that connection to one backend.

Key takeaways

• Layer 4 decides once per connection and sees only addresses, ports and TCP or UDP. It is cheap.
• Layer 7 terminates the connection and decides per request. That costs CPU but enables routing, retries and auth.
• Production systems usually stack them: layer 4 spreads connections across a fleet of layer 7 proxies.
• HTTP/2 and gRPC need layer 7 or client-side balancing to spread requests evenly.

Further learning

Hussein Nasser compares layer 4 and layer 7 balancing with HAProxy.

Next: balancing algorithms, which covers how the balancer picks a backend.