What is layer 7?

Traffic is described in layers, and each one sees less of the meaning than the one above.

At the lower levels, layers 3 and 4, there are addresses, ports, and packets. Something is travelling from somewhere to somewhere, and whether it is a shopping cart or an attack is not a question the level can answer, because the information is not there yet.

At layer 7 the pieces have been assembled into something intelligible. The request asks for a specific thing, in a specific way, with specific values, and it can be compared with what the same client asked a minute ago. That assembly is what makes judgement possible.

The OSI model divides network communication into seven layers, from the physical signal at layer 1 to the application at layer 7. The application layer is where protocols such as HTTP carry requests that mean something to a program.

The model is a teaching tool more than a description of real stacks, which merge several layers. It survives in security because it names the boundary that matters: defences below layer 7 see packets and connections, defences at layer 7 see requests.

Application layer protocols are the ones programs speak to each other: HTTP and HTTPS for the web, DNS for looking up names, SMTP and IMAP for email, and many others for file transfer, remote access and messaging. Each defines requests and responses that mean something to the program on the other end.

For websites, layer 7 almost always means HTTP. When people talk about layer 7 traffic, a layer 7 attack or a layer 7 rule, they usually mean HTTP requests, with their methods, paths, headers and bodies.

Layers 3 and 4 deliver data: layer 3 routes packets between addresses, layer 4 carries data between programs over TCP or UDP. Neither knows what the data means. Layer 7 is where it is read as a request, which is why a defence there can tell a search from an injection attempt, and a defence below cannot.

The cost is that layer 7 comes last. A connection has to be opened and a request received before it can be judged, so floods aimed at links or at connection state are dealt with lower down, for example by a stateful firewall. The lower layers have their own page, layers 3 and 4.

A layer 7 firewall, or application layer firewall, judges traffic by its content rather than by addresses and ports. For web traffic, it is the same thing as a web application firewall, which reads HTTP requests before they reach the application.

Network firewalls sometimes advertise layer 7 features, such as recognising which application a connection belongs to. That is a different job from reading each request and deciding whether it is an attack, so the label alone does not say how deep a device looks. The comparison is on WAF vs firewall.

The term is used constantly in security discussions, and almost always to mark a boundary rather than to describe a level.

A defence operating here can act on what traffic means: which endpoint is being hit, whether a value looks like an attempt to inject something, whether one client is behaving unlike any person would. That is the entire category of decision unavailable at lower levels.

The boundary is the other half, and it is the part to carry away. Something that never becomes a request is not visible here at all. Traffic that saturates a link before arriving, connections opened and abandoned, floods aimed at the network rather than the application: none of that reaches the level where meaning exists, so no amount of rule-writing addresses it. Which defence sees what is set out under WAF vs other defences, and how attacks divide by level under attack layers.

That single fact explains most confusion in this area. When a product claims to handle everything, the useful question is which level it operates at, because the answer bounds what it can possibly observe.

How attacks divide across levels is covered under attack layers, and the rest of the filtering vocabulary in this glossary.