Explain the differences between layer 4 and layer 7 load balancing, and when would a network engineer choose each?

Layer 4 (L4) and Layer 7 (L7) load balancing represent fundamental choices in network architecture, each operating at a distinct level of the OSI model with different capabilities and performance characteristics. An L4 load balancer operates at the Transport Layer (TCP/UDP), making decisions based solely on network-level information such as source and destination IP addresses and ports. It establishes a direct TCP connection between the client and the selected backend server, simply forwarding packets without inspecting their application-layer content. This approach is fast and efficient, as it requires minimal processing overhead.

Operational Differences

In contrast, an L7 load balancer operates at the Application Layer (HTTP/HTTPS, FTP, SMTP, etc.), allowing it to inspect the actual content of the application traffic. This deep packet inspection enables more intelligent routing decisions based on HTTP headers, URLs, cookies, query parameters, or even the content type. For example, an L7 load balancer can route requests for `/api/v1` to one set of servers and requests for `/images` to another, or implement sticky sessions based on cookies. This added intelligence comes with increased processing overhead compared to L4 balancing.

Best practice

Choose L4 load balancing when simplicity, raw speed, and high throughput are paramount, especially for non-HTTP applications or when you only need to distribute traffic across a pool of servers without needing content-aware routing. It is ideal for scenarios where the application servers themselves handle all the logic, and the load balancer just needs to efficiently pass connections. Choose L7 load balancing when you require advanced traffic management features such as SSL termination, content-based routing, URL rewriting, A/B testing, API gateway functionality, or granular health checks that depend on application responses rather than just TCP handshake success.

Edge case interviewers probe for

Interviewers often probe for an understanding of hybrid scenarios or the implications of SSL/TLS termination. For example, a common edge case involves using an L4 load balancer for initial high-volume distribution, with L7 load balancers positioned behind it to handle more complex application-specific routing. They might also ask about the performance impact of L7 load balancing, especially with SSL/TLS termination, where the load balancer must decrypt and re-encrypt traffic, consuming significant CPU resources.

Common mistake

A common mistake is to default to L7 load balancing for all scenarios without considering its performance overhead or complexity. While L7 offers powerful features, it introduces latency due to the need for full connection establishment, packet reassembly, and application-layer inspection. Another error is failing to consider the security implications, as L7 load balancers can also perform WAF-like functions or inspect traffic for malicious patterns, while L4 is more transparent to such threats.

What the interviewer is checking

The interviewer is checking your foundational knowledge of network layers, your ability to articulate the trade-offs between performance and functionality, and your practical understanding of when to apply each load balancing strategy in real-world application architectures. They want to see that you can design a robust and efficient network infrastructure considering both technical requirements and operational implications, including security and scalability.