Beyond the Interview Box: A Deep Dive into L4 (NLB) vs. L7 (ALB) Networking

In system design interviews, placing a generic “Load Balancer” box in front of app servers is an easy shortcut. Candidates often throw around terms like NLB, ALB, or API Gateway without considering the low-level mechanics of how traffic moves through them. However, choosing the right load balancer requires knowing what happens at the network layer.

This guide opens up that black box, dissecting how NLBs (Layer 4) and ALBs (Layer 7) process packets, how they manage underlying operating system sockets, and the hidden performance bottlenecks that can break them in production.

1. The Core Difference: Sockets & Connection Termination:

The fundamental architectural difference between an L4 and an L7 load balancer boils down to where the TCP connection terminates and how OS sockets are managed.

Layer 4 (NLB): Packet Stream Routing (No Connection Termination)

An L4 Network Load Balancer operates as a high-speed packet router using Network Address Translation (NAT). It does not terminate TCP connections or inspect application payloads.

• Socket Count on LB: 0 Application Sockets.
• How It Works: When a client sends a TCP SYN packet, the NLB inspects the IP header and TCP port, selects a backend server, modifies the packet headers (DNAT/SNAT), and forwards the packet.