L4 vs L7 — bytes or requests

An L4 proxy moves opaque TCP bytes; an L7 proxy parses HTTP and can see path, method, and headers — and only L7 can implement route-based policy.

Previously

A sidecar that owns 'policy' has to know what a request IS before it can apply any policy to it — that is the L4/L7 split.

Scene 03

L4 vs L7 — bytes or requests

Watch
Try it
Predict
Capture

L4 proxy: sees IPs, not bytes' meaning →

L7 sees path + headers · L4 sees only IP/port

What to watch for

The same request enters the same sidecar twice. First as L4: only the IP/port labels light up; the payload is a featureless byte bar. Flip the slider and the proxy's interior changes — the parsed HTTP envelope (method, path, headers) becomes visible.

Implementation

Highlighted lines are the ones running in the diagram right now.

L4Proxy.serve()

transport-layer pipe — bytes pass through opaquely

1def serve():
2    conn = accept(':8080')
3    upstream = dial('backend:8080')
4    # splice both directions; never look inside
5    pipe(conn, upstream)
6    pipe(upstream, conn)
7    # we don't even know if it's HTTP

L7Proxy.serve()

application-layer parse — bytes become an HTTP request

1def serve():
2    conn = accept(':8080')
3    req = http.parse(conn)  # method, path, headers
4    route = match(routes, req)
5    upstream = dial(route.cluster)
6    resp = upstream.send(req)
7    http.write(conn, resp)

L7Proxy.match(routes, req)

the rules that only exist once HTTP is parsed

1def match(routes, req):
2    for r in routes:
3        if r.path and not req.path.startswith(r.path):
4            continue
5        if r.header:
6            name, want = r.header
7            if req.headers.get(name) != want:
8                continue
9        return r  # first match wins
10    return default_route

Where this sits in Build a Service Mesh (Envoy / Istio style)

Scene 03 of 13. An L4 proxy forwards opaque TCP bytes; an L7 proxy parses HTTP and can act on path, method, and headers. The mesh is L7 for everything that follows.

Up next. If the sidecar can read method and path, it needs a structured way to match on them and decide where to send the request next.

All 13 scenes in Build a Service Mesh (Envoy / Istio style) · Every curriculum

Built with Arqly

Every scene in Build a Service Mesh (Envoy / Istio style) builds on the one before it.All 13 Build a Service Mesh (Envoy / Istio style) scenes