Stage 4 · Provision
Load Balancing & Traffic Management
L4 vs L7 Load Balancing
TCP/UDP vs HTTP/gRPC — tradeoffs, performance characteristics, and when to use each.
The OSI Model Recap
Load balancers operate at different layers of the OSI model. Layer 4 (transport) handles TCP/UDP packets without inspecting content. Layer 7 (application) understands HTTP, gRPC, and WebSocket protocols and can make routing decisions based on request content.
L4 Load Balancing
L4 load balancers operate at the TCP/UDP level. They forward packets without inspecting the application payload. This makes them extremely fast and protocol-agnostic. They are ideal for non-HTTP protocols, database connections, and high-throughput scenarios.
Client ──TCP──► L4 LB ──TCP──► Backend Server
│
└── No HTTP inspection
└── No header manipulation
└── Just packet forwarding
└── Very low latency (~microseconds)L4 load balancers are implemented in kernel space (DPDK, XDP) or use kernel bypass. This gives them extreme throughput — millions of connections per second.
L7 Load Balancing
L7 load balancers terminate the TCP connection, parse the HTTP request, and make routing decisions based on headers, paths, cookies, and other application-level data. They can perform content-based routing, SSL termination, compression, and request transformation.
Client ──HTTPS──► L7 LB ──HTTP──► Backend Server
│
├── SSL termination
├── Path-based routing (/api → Service A)
├── Header inspection (X-User: premium)
├── Request rewriting
└── Higher latency (~milliseconds)L7 load balancers like NGINX, HAProxy, and Envoy provide rich routing capabilities but add latency because they must parse and reconstruct HTTP requests.
| Feature | L4 | L7 |
|---|---|---|
| Latency | Microseconds | Milliseconds |
| Throughput | Millions of conn/s | Thousands of req/s |
| Content inspection | No | Yes |
| Path-based routing | No | Yes |
| SSL termination | Passthrough only | Yes |
| Protocol support | Any TCP/UDP | HTTP, gRPC, WebSocket |
| Use case | Databases, raw TCP | Web apps, APIs |
Mixed Strategies
Many architectures use both L4 and L7 load balancers. An L4 load balancer distributes connections across L7 load balancers, which then route based on HTTP content. This gives you the speed of L4 at the edge and the intelligence of L7 closer to the application.
Use L4 at the edge for SSL passthrough and raw throughput. Use L7 internally for content-based routing, retries, and circuit breaking. This is how most production architectures at Google, Netflix, and Stripe are structured.
Choosing L4 or L7
- Use L4 for: databases, Redis, raw TCP, high-throughput internal services.
- Use L7 for: web APIs, gRPC, path-based routing, header manipulation.
- Use both when: you need the speed of L4 at the edge and the intelligence of L7 inside.
- Consider Envoy for both — it supports L4 TCP proxying and L7 HTTP routing in one binary.
Envoy proxy handles both L4 and L7 traffic. It is the data plane for Istio and provides consistent observability, retries, and circuit breaking across all protocols.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.