slammed.st
Sign inStart free

RESOURCES

Layer 7

Layer 7 (L7) testing sends application-level traffic — HTTP(S), APIs, TLS, caches, gateways — to measure user-path capacity on systems you control.

Infographic comparing Layer 4 network stress testing and Layer 7 application stress testing for authorized targets
Layer 4 vs Layer 7 stress testing — authorized targets only

Definition

Layer 7 is the application layer. In authorized load testing, L7 scenarios issue realistic HTTP(S) (and similar) requests against verified hosts and APIs. You watch RPS, p95/p99 latency, 5xx rates, cache hit ratio, and WAF challenge rates on legitimate paths.

Choose L7 when the risk is the product journey — auth, search, checkout, GraphQL — not only the network pipe. Pair with Layer 4 when perimeter capacity is a separate question.

Guides: Layer 7 stress testing · API use case.

Why it matters for authorized load testing

Campaign and launch failures are often L7: pool exhaustion, slow handlers, cache bypass, rate-limit surprises. A high L4 Gbps result can hide a fragile origin. Authorized L7 rehearsals on owned paths find those cliffs before customers do.

Separate cacheable browse traffic from write/conversion paths so a pretty homepage does not mask checkout pain. Keep abort criteria tied to user-visible latency and errors.

How Slammed.st uses it

Configure L7 methods in the Hub, select regions, set concurrents within plan limits, and run only on verified targets. Live metrics and reports capture throughput and latency for the retrospective.

Start free trial · Pricing · RPS vs concurrents tool.

Glossary cluster

Browse related term pages and the hub glossary:

Free trial · Pricing · Authorized load testing

How teams misuse the Layer 7 label

People say “we did L7” when they only flooded a single URL with no auth, no abort plan, and no origin metrics. Layer 7 in authorized practice means exercising the application path you care about — TLS, gateways, caches, handlers, and data stores — and reading application signals (RPS, latency percentiles, error classes), not only whether sockets opened.

Contrast with Layer 4 when the hypothesis is the pipe. Broader index: glossary. Method guide: Layer 7 stress testing.

Sequence for an L7 vocabulary drill

  1. Name the journey (auth, search, checkout) and the status codes that count as success.
  2. Verify the target; smoke until Hub and APM agree.
  3. Hold a plateau; record RPS with p95/p99 and errors.
  4. Stop on abort criteria; cool down before claiming a pass.

Size workers via concurrent vs RPS and pricing. Trial: register.

When Layer 7 definitions should not drive the test

If stakeholders only need NIC or scrubbing validation, do not force an HTTP story — use L4. If you need CI protocol fidelity on every PR, keep scripts and reserve Hub L7 for shared rehearsals. Unauthorized third-party application testing is out of scope.

Related reading on the blog, policy at authorized load testing, and product controls in docs.

Related

Resources hub · Glossary · Tools matrix · RPS calculator · Useful network tools · Blog · Pricing · Start free