Azure Load Balancer algorithm

Load balancer provides several capabilities for both UDP and TCP applications.

Load balancing algorithm

By creating a load balancer rule, you can distribute inbound traffic flows from a load balancer's frontend to its backend pools. Azure Load Balancer uses a five-tuple hashing algorithm for the distribution of inbound flows (not bytes). Load balancer rewrites the headers of TCP/UDP headers flows when directing traffic to the backend pool instances (load balancer does not rewrite HTTP/HTTPS headers). When the load balancer's health probe indicates a healthy back-end endpoint, backend instances will be available to receive new traffic flows.

By default, Load balancer uses a five-tuple hash.

The hash includes:

  • Source IP address
  • Source port
  • Destination IP address
  • Destination port
  • IP protocol number to map flows to available servers

Application independence and transparency

Load balancer supports any TCP/UDP application scenario and doesn't close or originate flows. Load balancer also doesn't interact with the payload of any flow.

  • Application payloads are transparent to the load balancer. Any UDP or TCP application can be supported.

Load balancer operates on layer 4 and doesn't provide application layer gateway functionality. Protocol handshakes always occur directly between the client and the back-end pool instance.

  • Because the load balancer doesn't interact with the TCP payload nor does it provide TLS offload, you can build comprehensive encrypted scenarios. Using load balancer gains large scale-out for TLS applications by ending the TLS connection on the VM itself. For example, your TLS session keying capacity is only limited by the type and number of VMs you add to the back-end pool.

A response to an inbound flow is always a response from a virtual machine. When the flow arrives on the virtual machine, the original source IP address is also preserved.

  • Every endpoint is answered by a VM. For example, a TCP handshake occurs between the client and the selected back-end VM. A response to a request to a front end is a response generated by a back-end VM. When you successfully validate connectivity to a front end, you're validating the connectivity throughout to at least one back-end virtual machine.

Next steps