Layer 3/4 vs Layer 7 protection: what is the difference?

02Side by side

03Which attacks hit which layer

Record attacks show why both layers matter, and why they are quoted in different units, as bps vs pps vs rps explains. The HTTP/2 Rapid Reset attack peaked at 398 million requests per second against Google Cloud in August 2023, far above the 46 million rps record of the year before. At the network layer, Cloudflare's report for the fourth quarter of 2025 recorded a 31.4 Tbps flood, and network-layer attacks made up 78% of the attacks it mitigated in that quarter.

04Which one do you need?

If the thing you are protecting is reached by a browser or an HTTP client — a website, a shop, an API — Layer 7 protection is both necessary and sufficient. You point DNS at a reverse proxy and it inspects everything.

If it is reached by anything else — a game client on a UDP port, a mail server on 25, a VPN endpoint, a custom binary protocol — Layer 7 cannot help, because there is no HTTP to inspect. You need packet-level filtering in front of the machine, usually delivered over a GRE tunnel so your server's real address never appears in public routing.

Many businesses need both, and they compose cleanly: the website runs through the HTTP proxy while the game or voice servers run through filtered transit.

05What common services need

In every case the protocol decides it. TCP and UDP behave differently under attack, and a UDP service cannot be put behind an HTTP proxy at all. For a worked TCP example, see protecting a Minecraft server from DDoS.

06How to tell which layer is under attack

During an incident, four quick measurements usually settle it: is the link full, is the connection table full, which packets dominate, and is the application busy? Replace eth0 with your interface and access.log with your web server's log in the common combined format.

# 1. Link: packet and byte counters; run twice a few seconds apart and compare
ip -s link show dev eth0

# 2. Connections: half-open sockets and SYN cookie activity
ss -Htn state syn-recv | wc -l
nstat -az TcpExtSyncookiesSent TcpExtListenOverflows

# 3. Packets: SYNs without ACK, or UDP from common reflection ports
tcpdump -nni eth0 -c 2000 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'
tcpdump -nni eth0 -c 2000 'udp and (src port 53 or src port 123 or src port 389 or src port 1900 or src port 11211)'

# 4. Application: busiest seconds, then most requested paths without query strings
awk '{print substr($4, 2, 20)}' access.log | uniq -c | sort -rn | head
awk '{split($7, p, "?"); print p[1]}' access.log | sort | uniq -c | sort -rn | head

07How Layer 3/4 protection is delivered

Because packets cannot simply be pointed somewhere with a DNS record, Layer 3/4 protection changes routing instead. The usual mechanism is a GRE tunnel: a virtual point-to-point link between the scrubbing network and your server.

Traffic for your protected addresses arrives at the provider, is filtered there, and the clean remainder is encapsulated and delivered to your machine through the tunnel. Your server replies either through the tunnel or directly, depending on the set-up. Either way, the address the world sees belongs to the provider, and your real address stays hidden. The delivery options are compared in remote DDoS protection explained.