Understanding SLB (Server Load Balancer) Transmission Modes and Packet Analysis

SLB (Server Load Balancer) distributes client requests across multiple backend servers by using a virtual IP (VIP) and load‑balancing algorithms, preventing overload of individual servers and improving service reliability.

Three transmission modes are supported:

Reverse‑proxy mode (layer‑7 SLB): the load balancer terminates the client connection, rewrites source and destination IPs, forwards the request to the selected real server (RS), and then rewrites the response back to the client.

Transparent mode (layer‑4 SLB): the client’s original IP is preserved; the load balancer forwards packets to the RS without altering source IP, and the RS replies directly to the client, with the balancer only adjusting the VIP on the return path.

Triangular mode: the balancer forwards the packet to the RS based on MAC address while the RS uses the VIP as its source IP, allowing the RS to send responses directly to the client without further processing by the balancer.

In reverse‑proxy mode, the balancer records the original packet fields, changes the destination IP to the chosen RS, and replaces the source IP with its own downstream interface IP before forwarding. The RS replies to the balancer, which then rewrites the source back to the VIP and sends the response to the client.

Transparent mode keeps the client’s IP unchanged; the balancer forwards the packet to the RS, which sees the client’s real IP as the source. The RS replies directly to the client, and the balancer only substitutes the VIP on the return path.

Triangular mode forwards the packet to the RS based on MAC address while the RS uses the VIP as its source IP (typically configured on a loopback interface). The RS then sends the response directly to the client, making this mode suitable for high‑throughput or many‑connection scenarios.

The analysis shows that reverse‑proxy mode can enhance security by allowing firewalls to filter traffic based on the balancer’s IP and by adding X‑Forwarded‑For headers, while transparent and triangular modes preserve client IP visibility but require careful routing configuration.

Overall, understanding these SLB modes and their packet flows helps architects design robust, secure, and efficient load‑balancing solutions.