Load Balancer — L4 vs L7
The Question
What is the difference between L4 and L7 load balancers?
What a Strong Answer Covers
- L4 = IP/port
- L7 = HTTP content
- SSL termination at L7.
Senior-Level Answer
L4 and L7 load balancers operate at different layers of the OSI model and serve different purposes.
L4 load balancing operates at the transport layer. It makes routing decisions based on TCP or UDP header data — source/destination IP, ports, and protocol type. It does not inspect the payload. When a connection arrives, the load balancer selects a backend and forwards all packets for that connection. Examples: AWS Network Load Balancer (NLB), HAProxy in TCP mode, Linux IPVS.
L7 load balancing operates at the application layer. It terminates the client connection, parses the full request (HTTP headers, URL path, cookies, request body), and makes intelligent routing decisions. This enables path-based routing (/api/* to API servers, /static/* to CDN), session affinity via cookies, A/B testing, rate limiting, and WAF integration. Examples: AWS Application Load Balancer (ALB), NGINX, Envoy.
SSL/TLS termination is a key differentiator. L7 balancers typically terminate TLS, decrypting traffic to inspect HTTP content. L4 balancers can pass through TLS without terminating it.
Performance: L4 balancers are faster and handle more connections per second — minimal processing, microsecond latency. L7 balancers add low-millisecond latency for parsing and buffering, but can optimize with HTTP/2 multiplexing and connection pooling.
Connection handling: L4 maintains a single client-to-backend connection (transparent). L7 maintains two separate connections: client-to-LB and LB-to-backend, requiring X-Forwarded-For to preserve client identity.
Use L4 for raw throughput and non-HTTP protocols (gaming, database connections). Use L7 for content-aware routing and API gateway functionality.
In modern architectures, both are often used together — L4 at the edge distributing to multiple L7 balancers, which then perform intelligent routing.
Key Differences
| Aspect | L4 (Transport) | L7 (Application) |
|---|---|---|
| OSI Layer | Layer 4 — TCP/UDP | Layer 7 — HTTP/HTTPS/gRPC |
| Routing Basis | IP, port, protocol | URL path, headers, cookies, body |
| Content Inspection | No — payload is opaque | Yes — full request parsing |
| SSL/TLS | Passthrough (no decryption) | Terminates TLS, can inspect content |
| Performance | Higher throughput, microsecond latency | Lower throughput, millisecond latency |
| Connection Model | Single pass-through connection | Two connections (client→LB, LB→backend) |
| AWS Example | Network Load Balancer (NLB) | Application Load Balancer (ALB) |
What Separates a 2/3 from a 3/3
2/3 — Passing but Incomplete
Correctly identifies L4 = transport layer, L7 = application layer, gives basic examples but does not discuss SSL termination or connection models.
3/3 — Strong Answer
Explains both layers with concrete routing capabilities, covers SSL termination, discusses performance tradeoffs, gives real product examples, and explains the combined L4+L7 pattern.
Common Mistakes
- Saying L4 'cannot handle HTTPS' — it can via TLS passthrough
- Not mentioning that L7 maintains two separate connections and requires X-Forwarded-For
- Treating L7 as strictly superior rather than explaining the tradeoffs
- Forgetting non-HTTP use cases for L4
- Confusing load balancer functionality with reverse proxy functionality
Follow-Up Questions
- How does TLS passthrough work at L4? — LB forwards encrypted traffic without decrypting; backend terminates TLS.
- What load balancing algorithms work at L4 vs L7? — L4: round-robin, least connections, IP hash. L7 adds: URL hash, cookie-based affinity, header-based rules.
- How does connection draining work differently at L4 and L7? — L4 waits for TCP connections to close. L7 can stop new requests while allowing in-flight HTTP requests to complete.
- What is an Envoy sidecar proxy? — Service mesh pattern — each pod gets an L7 proxy for traffic management, observability, and mTLS.
- How would you debug a 502 Bad Gateway from an L7 load balancer? — LB connected to backend but got invalid response — check backend health, timeouts, response format.
Related Questions
Can You Explain This Cold?
Reading the answer is step one. Explaining it unprompted — under interview pressure — is what actually matters. Get AI-graded feedback on your answer with follow-up probes on your weak points.
Get Graded — Free Assessment