Load balancers distribute traffic across backend servers. The key difference is which layer of the OSI model they operate on.
L4 (Layer 4 — Transport) Load Balancing
Operates at the Transport Layer using TCP/UDP information.
| Feature | L4 Load Balancer |
|---|---|
| Decision basis | Source IP, destination IP, port, protocol |
| Packet inspection | Headers only — no payload |
| Performance | Very high (can handle millions of packets/sec) |
| Routing | Directs TCP/UDP connections to a backend server |
| Encryption | Cannot decrypt — passes traffic as-is |
Example: AWS Network Load Balancer (NLB). Simply forwards TCP connections. If the backend server pool changes, the TCP connection is broken.
Best for: Raw throughput, non-HTTP protocols (gRPC, DNS, WebSocket), TLS passthrough.
L7 (Layer 7 — Application) Load Balancing
Operates at the Application Layer — can read the actual content.
| Feature | L7 Load Balancer |
|---|---|
| Decision basis | URL path, HTTP headers, cookies, request body |
| Packet inspection | Full payload — can understand HTTP, gRPC, etc. |
| Performance | Lower than L4 (requires more CPU to parse payload) |
| Features | Content-based routing, SSL termination, session stickiness, caching |
| Encryption | Can terminate TLS and see plaintext HTTP |
Example: AWS Application Load Balancer (ALB), Nginx, HAProxy.
Example routing: /api/users/* → backend group A, /static/* → backend group B.
Comparison
| Aspect | L4 | L7 |
|---|---|---|
| OSI layer | 4 (Transport) | 7 (Application) |
| Decision | IP + port | URL, headers, cookies |
| Performance | Higher | Lower (more CPU) |
| TLS termination | No (passthrough) | Yes |
| Content routing | No | Yes |
| Session stickiness | By source IP | By cookie |
| Use case | High throughput, raw TCP/UDP | HTTP-based applications |
Q: What’s the difference between L4 and L7 load balancing?
A: L4 load balancers make routing decisions based on IP addresses and ports — they’re fast but can’t inspect content. L7 load balancers understand HTTP — they can route by URL path, headers, or cookies, and can terminate TLS. Use L4 for raw throughput; use L7 for smart HTTP routing.
Q: When would you use L4 instead of L7?
A: When you need high throughput, handle non-HTTP protocols (gRPC, WebSocket, DNS), or want TLS passthrough (the backend handles decryption). L4 is simpler and faster.
Q: What is TLS termination at the load balancer?
A: The L7 load balancer decrypts incoming HTTPS traffic, forwards plain HTTP to backend servers, and encrypts the response. This offloads expensive crypto operations from backend servers and allows the load balancer to inspect HTTP content for routing decisions.
Q: Can an L7 load balancer do L4 routing?
A: Yes — you can configure an L7 balancer to pass through TCP connections unchanged for specific ports. But it’s less efficient than a dedicated L4 balancer for that purpose.
Premium Content
Unlock L4 vs L7 Load Balancing and all premium lessons with a subscription.
From ₹199.99/year — See plans