Load Balancing Cheatsheet

L4 vs L7

	L4 (transport)	L7 (application)
Sees	IP + port	URL, headers, cookies
Routes by	connection / 5-tuple	path, host, header
Speed	fastest	parses payload
Features	minimal	TLS term, WAF, rewrites
AWS	NLB	ALB

L4 = throughput / non-HTTP. L7 = content routing, TLS, per-request logic (most web).

Algorithms

Algorithm	Best for
Round robin	Uniform, short requests
Weighted RR	Unequal server capacities
Least connections	Long-lived / variable requests
Least response time	Adapt to slow nodes
IP hash	Stickiness, no shared state
Consistent hash	Cache / shard affinity

Health Checks & Stickiness

Check	Verifies
Passive	Ejects after N live-traffic failures
Active TCP	Port accepts a connection
Active HTTP	GET /healthz -> 200 in time

Sticky sessions: cookie-based or IP-hash
  -> needed only if state is in server RAM
  -> PREFER stateless (Redis/JWT); sticky breaks autoscale
liveness vs readiness: don't cascade-eject on shared dep blip

TLS & GSLB

TLS termination: client--TLS-->[LB]--HTTP-->backend (offload, central certs)
TLS passthrough: LB forwards encrypted (end-to-end, no L7 inspect)
Re-encryption:   terminate then new TLS to backend (both)

GSLB	Routing
DNS-based	Region IP by geo; TTL caching delays failover
Anycast	One IP, BGP to nearest PoP; fast failover
GeoDNS + latency	Route to lowest-latency datacenter

HA & Tools

HA topology	Behavior
Active-passive	Standby claims VIP on failure (idle capacity)
Active-active	All LBs serve; full capacity

VIP + keepalived (VRRP): MASTER holds VIP, BACKUP heartbeats,
  takes over via gratuitous ARP in ~seconds on failure

Tool	Strength
HAProxy	High-perf L4/L7
Nginx	Reverse proxy + LB + TLS
Envoy	Cloud-native L7, service mesh
AWS ELB	ALB L7 / NLB L4, managed

Reverse proxy = front door for backends (caching, TLS, routing), even for one server. LB = specifically spreads across many. Nginx/Envoy do both.