What Is a Load Balancer? (Layer 4 vs Layer 7)

📘 Chapter 6: Load Balancing & Reverse Proxies ⏱️ 8 min read 🏗️ Lesson 023

One server has finite capacity. Eventually requests pile up, response times climb, and the server falls over. A load balancer sits in front of multiple servers and distributes incoming requests across them — so no single server becomes a bottleneck.

The Problem: One Server Isn't Enough

Without vs With a Load Balancer Without Load Balancer Client Client Client Client Server 🔥 overloaded With Load Balancer Client Client Client Client LB Server 1 ✓ Server 2 ✓ Server 3 ✓ Single point of failure, performance bottleneck Distributed load, high availability
Figure 1: Without a load balancer, all traffic hits one server. With a load balancer, traffic is distributed evenly across multiple servers.

Layer 4 vs Layer 7: Two Levels of Intelligence

Load balancers operate at different layers of the network stack. The two most common are Layer 4 (Transport) and Layer 7 (Application). The layer determines what information the LB can see — and therefore how smartly it can route.

Layer 4 — Transport Layer

  • Routes based on IP address and TCP/UDP port
  • Cannot inspect packet contents (no knowledge of HTTP, URLs, headers)
  • Extremely fast — just forwards TCP connections
  • Lower resource usage, higher throughput
  • Use case: internal service-to-service traffic, database connections, gaming servers

Layer 7 — Application Layer

  • Routes based on HTTP content: URL path, headers, cookies, request body
  • Can make intelligent decisions: send /api/* to API servers, /static/* to CDN
  • Can modify requests/responses (add headers, rewrite URLs)
  • Slightly higher latency due to content inspection
  • Use case: web applications, API gateways, microservice routing
OSI Layers: What L4 and L7 Can See Layer 7 — Application (HTTP, gRPC, WebSocket) Layer 6 — Presentation Layer 5 — Session Layer 4 — Transport (TCP/UDP, ports) Layer 3 — Network (IP) Layer 2 — Data Link Layer 1 — Physical ← L7 LB sees this ← L4 LB sees this What Each Layer Can Route On: L4: Source/Dest IP, Source/Dest Port L7: URL, Headers, Cookies, Method, Body
Figure 2: L4 load balancers see only transport info (IP + port). L7 load balancers see application content (HTTP details).

Hardware vs Software Load Balancers

Hardware LBs

Examples: F5 BIG-IP, Citrix ADC

Dedicated physical appliances with custom ASICs. Extremely high throughput, but expensive ($50k–$500k+), proprietary, and hard to scale. Still found in enterprise data centers and financial institutions.

Software LBs

Examples: Nginx, HAProxy, Envoy, Traefik

Run on commodity hardware or cloud VMs. Cheaper, easier to configure and scale, open-source options available. The modern standard — even cloud providers' managed LBs (AWS ALB/NLB, GCP Cloud Load Balancer) are software-based.

Where Load Balancers Sit in Architecture

Two Tiers of Load Balancing

  • External (internet-facing): Between clients and your web/API servers. Handles SSL termination, DDoS protection, and routes to the right service.
  • Internal (service-to-service): Between microservices. Routes requests from Service A to one of many instances of Service B. Often L4 for speed.

Health Checks: How LBs Know When a Server Is Down

A load balancer periodically checks each backend server:

  • TCP check: Can I open a connection to port 8080?
  • HTTP check: Does GET /health return 200?
  • Custom check: Does the response body say {"status": "ok"}?

If a server fails consecutive health checks, the LB removes it from the pool. When it passes again, it's added back. This prevents routing traffic to dead or degraded instances.

🏢 Real-World: Stripe's Envoy-Based Load Balancing

Stripe uses Envoy as an L7 load balancer between their microservices. Envoy runs as a sidecar proxy alongside each service, giving them fine-grained control over routing (canary deployments, header-based routing), automatic retries, circuit breaking, and detailed observability — all without changing application code. This "service mesh" pattern (Envoy sidecars communicating) has become the standard for large-scale microservice architectures.

Interactive: L4 vs L7 — What Can You Route On?

Toggle between L4 and L7 mode to see what information is available for routing:

── Transport Layer (always visible) ──
Source IP: 192.168.1.42
Dest IP: 10.0.0.5
Source Port: 54321
Dest Port: 443
Protocol: TCP
L4 Routing Decision: Forward to any backend on port 443 based on IP hash or round robin. Cannot distinguish between API calls, static files, or WebSocket connections.