Lesson 3.3• 6 min read

Load balancing: layer 4 versus layer 7

Transport-level packet routing versus application-level HTTP inspection and routing.

What you will learn

Say what a load balancer does beyond spreading requests.
Compare layer 4 and layer 7 load balancers by what they read and what they cost.
Choose a routing method, and explain direct server return.

Load Balancing Fundamentals

A load balancer distributes incoming client requests to computing resources such as application servers and databases, and returns each response to the right client. It keeps requests away from unhealthy servers, prevents overloading any one resource, and helps eliminate a single point of failure.

Layer 4 (L4) vs Layer 7 (L7) load balancers

Dimension	Layer 4 (transport level)	Layer 7 (application level)
Looks at	Source and destination IP addresses and ports, not the packet contents	The request itself: headers, message and cookies
How it forwards	Forwards packets to and from the server, performing network address translation (NAT)	Terminates the client connection, reads the request, chooses a server, then opens a connection to it
TLS	Usually passes encrypted traffic through; some (such as an AWS Network Load Balancer with a TLS listener) can terminate it	Terminates TLS, so it can read and route on the request
Cost	Needs less time and computing power per request	More flexible, but costs more per request; on modern hardware the difference can be small
Examples	AWS Network Load Balancer, Linux IPVS, HAProxy in TCP mode	AWS Application Load Balancer, NGINX, HAProxy in HTTP mode, Envoy

Because it reads the request, an L7 load balancer can, for example, send video traffic to servers that host video while sending billing traffic to security-hardened servers.

Routing methods

Round robin: Requests go to each server in turn; weighted round robin gives a larger share to servers with a higher weight.
Least connections: Each request goes to the server with the fewest active connections, so slow requests do not pile up on one server.
IP hash: A hash of the client's IP address picks the server, so the same client keeps landing on the same server.
Random, least loaded, and session or cookie based routing are other common choices.

Direct server return (DSR)

Normally both the request and the response pass through the load balancer. With direct server return, as in Linux Virtual Server's direct-routing mode, the load balancer only rewrites the destination MAC address of each incoming frame and forwards it to the chosen server on the same LAN; the server then replies directly to the client, so response traffic never passes back through the load balancer.

Layer 4 versus layer 7 routing

Routing inspection

HTTP path, headers, cookies

SSL/TLS termination

Terminated at LB

Work per request

Higher: terminates and reads each request

Test incoming request routing:

Resolved target: Order service pods (app tier)

Matched via HTTP URL rule

Layer 7 (ALB / NGINX / HAProxy): Operates at the application layer. It terminates the TCP connection and decrypts TLS, enabling intelligent path-based routing, HTTP/2 multiplexing, header mutation, and sticky cookie affinity.

Figure 3: Layer 7 Application Load Balancer performing SSL termination and URL path dispatching.

Key takeaways

A load balancer spreads requests, keeps them away from unhealthy servers and helps remove a single point of failure.
Layer 4 forwards by addresses and ports and is cheap; layer 7 terminates the connection, reads the request and can route on its path, headers or cookies.
Round robin, least connections and IP hash suit different loads; least connections stops slow requests piling up on one server.
With direct server return, responses go straight from the server to the client and skip the load balancer.

Sources

Adapted from The System Design Primer by Donne Martin, licensed under CC BY 4.0. Changes were made.