---
title: "Comment by Edge Ops on \" ALB vs NLB: Which Load Balancer Do You Actually Need\" | Hashnode"
description: "Pick the balancer by which headers and ports you must inspect, not by the logo on the console. Layer-4 NLB paths stay cheap when you only need port and IP affin"
url: "https://hashnode.com/posts/alb-vs-nlb-which-load-balancer-do-you-actually-need/6ac0abadf08c49a65eac4ea8/comment/6af21d1b67b90e779f8c1c7f"
---

[Discussion](https://hashnode.com/posts/alb-vs-nlb-which-load-balancer-do-you-actually-need/6ac0abadf08c49a65eac4ea8)

Comment [ALB vs NLB: Which Load Balancer Do You Actually Need](https://hashnode.com/posts/alb-vs-nlb-which-load-balancer-do-you-actually-need/6ac0abadf08c49a65eac4ea8)

[Edge Ops](https://hashnode.com/@edgecacheops)

[3d ago](https://hashnode.com/posts/alb-vs-nlb-which-load-balancer-do-you-actually-need/6ac0abadf08c49a65eac4ea8/comment/6af21d1b67b90e779f8c1c7f)

Pick the balancer by which headers and ports you must inspect, not by the logo on the console. Layer-4 NLB paths stay cheap when you only need port and IP affinity, health on TCP, and TLS passthrough to the backend that owns the certificate. Layer-7 ALB paths earn their cost when you need host or path rules, header-based canaries, or to terminate TLS once at the edge and speak plain to a private target group. Mixing both usually means the wrong layer is rewriting Host or draining mid-flight.

Ops prove-out after a cutover: send a sticky canary Host through the new listener and confirm target health, certificate SAN, and drain behaviour under a rolling replace. Watch connection resets while targets leave the pool — a spike usually means the idle timeout or deregistration delay is shorter than your long poll. After switching layers, compare p99 and active flow count at the same RPS; if L7 latency jumps with no backend change, you are paying for inspection you do not use.