Kernel & User mode
IIS and it's main components
Different Modes of Operations
• The primary function of a web server is to
deliver web pages on requests from clients using
• It can be referred as hardware(computer) or the
software (computer application)
• Hosts websites/web application to serve www.
• Found embedded in devices like printers,
routers, web-cams to serve local network
• Able to map URL to a local file system resource
(static requests) as well as internal or external
program name (dynamic requests)
Kernel & User Mode
• The executing code
has complete and
to the underlying
• Kernel mode is
for the lowest-level,
functions of the
• The executing code
has no ability to
• Code running in user
mode must delegate
to system APIs to
access hardware or
Kernel & User Mode
• Crashes in kernel
will halt the entire
• Usually work faster,
because, as part of
the system, it can
directly use all the
• Crashes in user mode
• Comparatively slow
as they have to ask
the system the
permission to use
more memory or
more CPU resources.
IIS main components
• Designed to provide secure, scalable solutions for
creating and managing www sites and servers
• We can publish information on intranets,
extranets and the internet
• Provides FTP, SMTP, Indexing and other services
– Worker processes (W3wp.exe)
– Application pools
• Also known as “HTTP Protocol Stack” or “Http
• Implemented as a kernel-mode device driver
• core component to receive and serve HTTP
requests and passing them off to the worker
• When you create a Web site, IIS registers the site
• Other than retrieving a stored response from its
internal cache, HTTP.sys does not process the
requests that it receives.
• A worker process is user-mode code whose role is
to process requests, such as processing requests
to return a static page
• The worker process is controlled by the WWW
• A worker process runs as an executable file
• Worker processes also run application code, such
as ASP.NET applications and XML Web services.
• Internet Server Application Programming
Interface, is an API developed to provide the
application developers with a powerful way to
extend the functionality of IIS
• Extensions and Filters are the two types of
applications that can be developed using ISAPI
• ISAPI extensions are true applications that run on
IIS and have access to all of the functionality
provided by IIS
• ISAPI extensions are implemented as DLLs that
are loaded into a process that is controlled by IIS
• Like ASP and HTML pages, IIS uses the virtual
location of the DLL file in the file system to map
the ISAPI extension
• ASP.Net functionality is contained in an ISAPI
extension called aspnet_isapi.dll
• Any file that is requested from the IIS server that
ends in “.aspx” is mapped to aspnet_isapi.dll
which is assigned to process the file before
displaying its output in the client’s window
• ISAPI filters are DLL files that can be used to
modify and enhance the functionality provided
• ISAPI filters always run on an IIS server, filtering
every request until they find one they need to
• Mostly used for Authentication and Encryption of
the i/p or o/p data for a site locally or all the
• A user-mode component that hosts the IIS
metabase and that also hosts the non-Web
services like the FTP, SMTP etc
• Used to manage ISAPI applications that run
within the IIS process context
• The services that run in Inetinfo.exe run as
dynamic-link libraries (DLLs) under the Local
• In IIS5.0 or IIS6.0 runs in IIS5.0 isolation mode
>Inetinfo.exe hosts the worker process
• Group of Web Applications and Web Sites are
called Application Pools
• Every application within an application pool
shares the same worker process
• The worker process(w3wp.exe) that services one
application pool is separated from the worker
process that services another
• Each separate worker process provides a process
boundary so each application pool is separated
by these process boundaries
IIS Different Modes of
• IIS 5.0 isolation mode
(InetInfo.exe takes the ownership for request
• IIS 6.0 worker process isolation mode
(worker process W3wp.exe takes the ownership for
• A request arrives. If the requested application is running in-
process, then Inetinfo.exe takes the request. If not, then
DLLHost.exe takes the request.
• Inetinfo.exe or DLLHost.exe determines if the request is valid.
If the request is not valid, it sends a code for an invalid request
back to the client.
• If the request is valid, Inetinfo.exe or DLLHost.exe checks to
see if the response is located in the IIS cache.
• If the response is in the cache, it is returned immediately.
• If the response is not cached, Inetinfo.exe or DLLHost.exe
processes the request, by evaluating the URL to determine if
the request is for static (HTML), or dynamic content (ASP)
• The response is sent back to the client and the request is
logged, if IIS is configured to do so.
• A request arrives at HTTP.sys.
• HTTP.sys determines if the request is valid. If the request is not
valid, it sends a code for an invalid request back to the client.
• If the request is valid, HTTP.sys checks to see if the request is
for static content (HTML) because static content can be served
• If the request is for dynamic content, HTTP.sys checks to see if
the response is located in its “kernel-mode cache”.
• If the response is in the cache, HTTP.sys returns the response
• If the response is not cached, HTTP.sys determines the correct
“request queue”, and places the request in that queue.
• If the queue has no worker processes assigned to it, HTTP.sys
signals the WWW service to start one.
• The worker process pulls the request from the queue and
processes the request, evaluating the URL to determine the
type of request (ASP, ISAPI, or CGI).
• The worker process sends the response back to HTTP.sys.
• HTTP.sys sends the response back to the client and logs the
request, if configured to do so.