Layer 4 (transport) vs Layer 7 (application) — Dstat comparison
Layer 4 and Layer 7 describe two different planes of a DDoS test, measured in different units and defended in different ways.
Layer 4 (transport)
- Measured in bandwidth (Gbps) and packets per second (pps).
- Targets raw TCP/UDP capacity of links and devices.
- Mitigated upstream by scrubbing and capacity.
Layer 7 (application)
- Measured in requests per second (RPS).
- Targets application/CPU cost of HTTP handling.
- Mitigated by WAF, JS challenges, CAPTCHA and rate limits.
How each layer shows up on a Dstat graph
A Layer4 Dstat plots bandwidth and packet rate. The curve rises with the volume of TCP/UDP packets arriving at the edge, regardless of whether those packets carry a valid application payload. Saturation is visible as a plateau at the link ceiling: additional traffic no longer raises the line because the link cannot carry more.
A Layer7 Dstat plots HTTP requests per second, and on protected targets splits them into passed, bypassed and blocked. The same attack volume can produce very different curves depending on the protection in front of the origin: an unprotected endpoint shows a single high line, while a challenged endpoint shows a high incoming line with a bypass line that stays close to zero.
Which layer to test first
Test Layer 4 first when the question is whether the network path can carry the expected volume: hosting capacity, upstream scrubbing and edge filtering are all validated by bandwidth and pps figures. A Layer 7 test on a link that is already saturated measures the link, not the application.
Test Layer 7 when the network path is known to hold and the question is how the application and its protections behave under request floods. This is where WAF rules, JS challenges, CAPTCHA and rate limits are evaluated, and where the passed / bypass / blocked breakdown carries the most information.
Takeaway
Use Layer4 Dstat to gauge link saturation, and Layer7 Dstat to gauge how well application protections hold up under request floods.
Frequently asked questions
Can one Dstat show both Layer 4 and Layer 7?
No. The two layers use different units — bandwidth and pps versus requests per second — so they are plotted as separate Dstats. The live pages on this site are Layer7 Dstats; the Layer4 guide explains how a Layer4 Dstat is read.
Does a Layer 7 protection help against a Layer 4 flood?
No. JS challenges, CAPTCHA and rate limits act on HTTP requests. A TCP/UDP flood is absorbed or dropped at the network edge before any HTTP processing, so it must be mitigated by upstream capacity and scrubbing.
Why does a Layer4 Dstat report Gbps while a Layer7 Dstat reports RPS?
Because each unit matches what the layer exhausts. Layer 4 floods exhaust link and device capacity, which is measured in bits and packets. Layer 7 floods exhaust application and CPU time per request, which is measured in requests.