Question #29 of 60•Scaling•Medium• ~3 min read

What are the trade-offs of Layer 4 vs Layer 7 Load Balancing (HAProxy vs Envoy)?

Executive Takeaway

Analyze TCP/UDP packet routing at Layer 4 versus HTTP header parsing, path routing, and TLS termination at Layer 7.

Architectural Breakdown & AnalysisFAANG Aligned

Load balancers operate at different OSI layers, balancing packet processing speed against application routing intelligence.

Layer 4 Load Balancing (Transport Layer)

  • Routes TCP/UDP packets without reading application payloads.
  • Pros: Blazing fast throughput, minimal CPU usage, handles high connection counts.
  • Cons: Cannot inspect HTTP headers, cookies, or URL paths. No smart routing.

Layer 7 Load Balancing (Application Layer)

  • Terminates TLS, parses HTTP headers, cookies, and JSON URIs.
  • Pros: Intelligent path routing (/api/v1/orders → Order Pods), header rewrite, gRPC balancing.
  • Cons: Higher CPU overhead due to packet decryption and HTTP parsing.
NOTE — Production Hierarchy

Place a Layer 4 Load Balancer (AWS NLB / HAProxy) at the edge for TCP scale, pointing to Layer 7 Proxies (Envoy / Nginx) for intelligent application routing.

Key Architectural Comparison

Load Balancer TierOperating OSI LayerRouting Decisions Based OnThroughput / OverheadSSL / TLS Termination
Layer 4 (L4 / NLB)Transport Layer (TCP / UDP).IP address & Port number.Maximum (Zero packet inspection).Passthrough without decryption.
Layer 7 (L7 / ALB / Envoy)Application Layer (HTTP / gRPC).URL Path, Headers, Cookies, JSON body.Moderate (Requires full HTTP/2 framing).Full TLS offload & header inspection.
Previous QuestionHow do S3 and HDFS store petabytes of unstructured blob data reliably?Next Question How does OAuth 2.0 PKCE secure Single Page Applications (SPAs) & Mobile Apps?

Continue Learning on Being SDE

Explore deep-dive system architecture modules, low-level object-oriented designs, and interview cheat sheets.