If you have read anything about load balancers, firewalls or DDoS protection you have seen the term Layer 7. It comes from the OSI model, a seven-layer way of describing how data moves across a network. Layer 7 is the top of that stack: the application layer.
The OSI Model in One Paragraph
The OSI model splits networking into layers, each building on the one below it. The lower layers move raw bits and packets between machines. The upper layers give those bytes meaning. Layer 3 is IP addressing, Layer 4 is TCP and UDP ports, and Layer 7 is the protocols applications actually speak: HTTP, HTTPS, DNS, SMTP and the APIs your services expose.
What Lives at Layer 7
- HTTP and HTTPS requests: the page loads, form posts and asset fetches a browser makes.
- REST and GraphQL API calls between services and clients.
- DNS queries, mail (SMTP, IMAP), application-level authentication, and content itself.
- Anything a user or an application meaningfully interacts with, rather than the plumbing that carries it.
Layer 7 vs Layer 4
The practical difference is what a device can see. At Layer 4 a connection is a source and destination IP, a port and a protocol: a box working there knows that someone opened a TCP connection to port 443, and nothing more. At Layer 7 the same connection becomes a request with meaning: the host name, the URL path, the method, headers, cookies and the body. Anything that wants to make decisions based on what is being asked for, rather than who is connecting, has to work at Layer 7.
- Layer 4 decisions: allow or drop by IP and port, balance connections across servers, count connections per client.
- Layer 7 decisions: route /api to one pool and /shop to another, block a malicious query string, rate-limit the login page separately from the home page.
- The cost: to see Layer 7 inside HTTPS, a device must terminate TLS, which takes more CPU than forwarding packets.
Layer 7 Load Balancing and Routing
A Layer 7 load balancer, usually a reverse proxy such as Nginx, HAProxy or Envoy, reads each request before choosing where to send it. That enables routing by host name or path, sticky sessions based on a cookie, header-based canary releases, and caching of responses. A Layer 4 load balancer is faster and simpler but can only spread connections; it cannot tell a cheap static asset from an expensive search query.
Layer 7 Firewalls
A traditional firewall filters on Layer 3 and 4: addresses, ports and connection state. A Layer 7 firewall inspects the application traffic itself. For websites and APIs this is a web application firewall (WAF), which scores requests for injection, traversal and other abuse patterns; next-generation network firewalls apply the same idea to identify which application a flow belongs to. Neither replaces the other: the network firewall keeps unwanted ports closed, the Layer 7 firewall judges what arrives on the ports you leave open.
Layer 7 and DDoS
Layer 7 is also where the hardest DDoS attacks happen, because a request there can be cheap to send but expensive to answer. A single HTTP request to a search endpoint might trigger a database scan, a template render and a cache miss, and every request in the flood looks valid to a Layer 4 device.
The asymmetry
At Layer 7 the economics favour the attacker: a few bytes of request can cost you a full database query to serve. Good mitigation flips that ratio back.
Our guide to Layer 7 DDoS attacks covers the attack types, how to recognise each one and how to stop them.