Layer 4 vs Layer 7 Load Balancing: What Each Layer Sees

01 /What a Layer 4 balancer sees

A Layer 4 balancer works on the transport header: source and destination IP address, protocol number, source and destination port, and TCP flags. It sees the SYN, picks a real server, records the flow and forwards every subsequent packet of that connection by table lookup. It never assembles the byte stream and never knows what the payload is. That is its strength: it balances anything over TCP or UDP, at line rate, with one decision per connection. The basic model is described under server load balancing.

02 /What a Layer 7 balancer sees

A Layer 7 balancer completes the TCP handshake itself, receives the request, parses it and only then chooses a real server, to which it opens a second connection. Because it holds the full request it can route on the Host header, the URL path, a query parameter, a cookie, the method or the content type. It can rewrite headers, insert its own, redirect, compress, cache and apply persistence based on cookies. It is a proxy; every byte in both directions passes through its HTTP engine.

03 /URL switching and content switching

Content switching sends different parts of one site to different pools from one VIP: /images/ to static servers, /api/ to application servers, /admin/ to a restricted pool, with the Host header separating tenants that share the address. Foundry published a URL switching application note around 2001 and grouped the ServerIron GT, 4G and XL under an "application switch" product category, a label that meant Layer 7 aware load balancing in hardware. A whitepaper on balancing Microsoft Office Communications Server 2007 front-end pools belonged to the same family: the balancer had to understand the protocol well enough to keep a signalling session on one server.

04 /TLS termination and its cost

To read HTTP inside HTTPS the balancer must hold the certificate and private key and terminate TLS. That concentrates key management (convenient) and asymmetric cryptography (expensive) in one place. The full handshake dominates: a new TLS session costs orders of magnitude more CPU than forwarding a Layer 4 flow, which is why appliance vendors sold hardware acceleration and why balancer datasheets quote TLS handshakes per second separately from plain connections per second. Session resumption spreads the cost. Traffic to the real servers can be plain HTTP or re-encrypted, which doubles the crypto work.

05 /Performance and latency

Layer 4 adds microseconds: one table lookup and a header rewrite per packet, often in switching silicon. Layer 7 adds a full proxy hop: TCP handshake with the client, request parse, second handshake to the server, then two buffered streams. Expect connections per second to drop by an order of magnitude when a device moves from Layer 4 to Layer 7, and added latency in the low milliseconds per request. Neither matters until the balancer, not the servers, is the bottleneck.

06 /Header insertion: X-Forwarded-For and friends

In NAT or proxy mode the real server sees the balancer as the client, so logs, rate limits and geolocation all break. A Layer 7 balancer fixes this by inserting X-Forwarded-For with the original client address, X-Forwarded-Proto with the original scheme, or the standard Forwarded header (RFC 7239). Servers must trust these headers only from the balancer address and strip any copy a client sent, or the client can forge its own source. Layer 4 balancers cannot insert headers; they preserve the client address instead, which is why direct server return and Layer 4 are often chosen together.

07 /Layer 4 vs Layer 7 load balancing worked example: one site, two designs

Illustrative values. VIP 192.0.2.30 fronts real servers 10.2.0.11 and 10.2.0.12. Design A keeps the balancer at Layer 4 in direct server return: TCP 443 is forwarded untouched, the servers hold the certificate, the client address arrives unchanged. Design B terminates TLS on the balancer, routes /api/ to a second pool on 10.2.1.0/24, inserts X-Forwarded-For, and re-encrypts to 8443 with a client certificate.

# Design A, Layer 4 DSR: server log line and socket
203.0.113.7 - - [24/Sep/2026:10:14:02 +0000] "GET /api/orders HTTP/1.1" 200 512
$ ss -tn state established '( sport = :443 )' | head -2
ESTAB 0 0 192.0.2.30:443 203.0.113.7:51844
# Design B, Layer 7 proxy: same request at the API pool
10.2.0.1 - - [24/Sep/2026:10:14:02 +0000] "GET /api/orders HTTP/1.1" 200 512  xff=203.0.113.7
$ ss -tn state established '( sport = :8443 )' | head -2
ESTAB 0 0 10.2.1.11:8443 10.2.0.1:40122

In design A the server socket carries the VIP as its local address and the client as its peer, which is why the VIP must sit on a loopback. In design B the peer is always the balancer's inside address 10.2.0.1 and the client survives only as a header value, so the server's log, rate limiter and geolocation must read X-Forwarded-For from that one peer and no other. For non-HTTP protocols behind a source-NAT Layer 4 proxy, the PROXY protocol carries the same information as a preamble on the TCP stream; its version 1 line reads PROXY TCP4 203.0.113.7 192.0.2.30 51844 443.

08 /Operational differences by layer

The body integrity row matters. A Layer 7 device that compresses or re-chunks a response changes the bytes the client receives, so the digest fields a terminating proxy must recompute are what let a client prove the page arrived unchanged, and re-encrypting to the origin with a client certificate on the balancer's inside leg keeps the plaintext segment from being an unauthenticated hop.

09 /Decision table

The same logic applies one level down, where a Layer 2 versus Layer 3 switch trades simplicity for routing awareness: the higher layer is chosen for what it sees and paid for in throughput. A Layer 7 device is also the first point in the path that can read the User-Agent string and header order used when telling scripted clients from real browsers, and the rest of the balancing topics, from VIP basics to site selection, are gathered in the balancing guide index.

10 /Failure modes and pitfalls

• Trusting X-Forwarded-For from anyone. A server that reads the header from any peer lets an internet client set its own address. Accept it only from the balancer's inside address and drop any client-supplied value.
• Timeout mismatch at Layer 7. When the balancer's server-side keepalive outlives the server's own, the server closes an idle connection just as the balancer reuses it and the client gets a 502 for a request the server never saw. Keep the balancer's server-side idle timeout shorter.
• HTTP/2 hot spots at Layer 4. One connection carrying hundreds of multiplexed requests lands on one server, so connection counts look balanced while request counts are not.

11 /Expert tips

• Run both on one VIP: Layer 4 for ports that need throughput or passthrough, a Layer 7 virtual server only for ports whose routing needs the request.
• Size a terminating balancer on TLS handshakes per second with resumption disabled, not on plain connections per second.

Layer 4 vs Layer 7 load balancing is decided by what the routing decision needs to read, then paid for in throughput, key custody and operational duty. A site that needs both should run both, port by port, rather than lift everything to Layer 7.