What is the difference between L4 DDoS Protection and L7 DDoS Protection?

Short answer

The two work at different layers, each bound to a different object. L4 DDoS Protection is bound to the route table and comes ready in every route table; it filters the packets addressed to the device and passing through the device by rate per source, number of concurrent connections and packet format, before any request has formed (SYN flood, UDP flood, reflection & amplification, port scan, malformed packets). L7 DDoS Protection is bound to the vService and works only on HTTP and L7 TCP vServices on which L7 DDoS & Threat Protection is turned on; it measures the number of requests, connections and errors per source or for the vService total with a time window, and sets limits by the number of distinct addresses generating traffic, by country and by network type. Neither replaces the other; in an application open to the internet, the two are used together.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management	Status card (Active, Monitoring, Not active) and five protection bands	Packet and connection protection at the route table level
vService form → Details	L7 DDoS & Threat Protection	Turning on Bot/DDoS protection on the vService
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	L7 DDoS Protection card (Total Request Protection, Source IP Request Protection, Country Control …)	Request and connection volume protection at the vService level

Comparison

	L4 DDoS Protection	L7 DDoS Protection
Object it is bound to	Route table; comes ready in every route table	vService; when L7 DDoS & Threat Protection is turned on
Traffic it covers	Traffic addressed to the device and passing through the device	Traffic coming to HTTP and L7 TCP vServices; not present on Network vServices
What it looks at	Packet rate per second per source, number of concurrent connections, TCP flags and packet format	Number of requests, connections and errors in the time window; number of distinct source addresses; country and network type
Decision time	Before a request forms	When the connection or request arrives, before the content is inspected
Mode	Each rule carries its own mode: Disabled, Monitor, Block, Quarantine	The mode of the protection: Off, Monitor, Active; the blocks are also turned on and off separately
Enforcement	Dropping the packet or putting the source into quarantine	Depending on the block and the vService type, Silent drop, Block, Tarpit, Redirect, Show content, Show captcha, Quarantine, Bandwidth limit
Default value	Varies by rule: most of the rules that measure the flood rate are Monitor; most of the malformed packet and scan signatures, as well as the Management Ports rules, are Block	Starts in Monitor mode when protection is turned on
Typical attack	SYN flood, UDP flood, reflection & amplification, port scan, malformed packet	HTTP request flood, distributed request attack, scan that produces a large number of errors

Detailed comparison in the docs: L4 DDoS Protection · The Difference from Bot/DDoS and WAF.

Common Misconceptions

• "If L7 DDoS Protection is on, there is no need for L4 protection." An incomplete TCP handshake or a malformed packet never creates a request; L7 DDoS Protection cannot see this traffic, and it is filtered by L4 DDoS Protection.
• "L4 DDoS Protection is turned on per vService." L4 protection is at the route table level and is applied to the traffic in that route table; it does not need to be turned on separately, and only the mode and the limit of the rules are adjusted.
• "Network vServices are also protected by L7 DDoS Protection." L7 DDoS & Threat Protection exists only on HTTP and L7 TCP vServices; the traffic of a Network vService is protected at the L4 layer.

How it is done in the documentation

• L4 DDoS Protection · The Difference from Bot/DDoS and WAF
• L4 DDoS Protection · Terminology
• L7 DDoS Protection · The Blocks on the Card
• How to Enable Bot/DDoS Protection? · The Starting Modes of the Three Protections

Related questions

• What is a DDoS attack; at which layers does TR7 provide DDoS protection?
• What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?
• What is Threat State; what do the bands from No Attack to Active Attack describe?