Lets understand the Internet Information Services better by knowing the main components and peep into the different architecture

1. “Understanding our IIS”

2. Contents
 Web Server
 Kernel & User mode
 IIS and it's main components
 Different Modes of Operations
 Request Processing
 Take Away

3. Web Server
• The primary function of a web server is to
deliver web pages on requests from clients using
HTTP.
• It can be referred as hardware(computer) or the
software (computer application)
• Hosts websites/web application to serve www.
• Found embedded in devices like printers,
routers, web-cams to serve local network
• Able to map URL to a local file system resource
(static requests) as well as internal or external
program name (dynamic requests)

4. Kernel & User Mode
• The executing code
has complete and
unrestricted access
to the underlying
hardware.
• Kernel mode is
generally reserved
for the lowest-level,
most trusted
functions of the
operating system.
• The executing code
has no ability to
directly access
hardware or
reference memory.
• Code running in user
mode must delegate
to system APIs to
access hardware or
memory.

5. Kernel & User Mode
• Crashes in kernel
mode are
catastrophic; they
will halt the entire
PC.
• Usually work faster,
because, as part of
the system, it can
directly use all the
hardware resources
it needs.
• Crashes in user mode
are always
recoverable.
• Comparatively slow
as they have to ask
the system the
permission to use
more memory or
more CPU resources.

6. IIS main components
• Designed to provide secure, scalable solutions for
creating and managing www sites and servers
• We can publish information on intranets,
extranets and the internet
• Provides FTP, SMTP, Indexing and other services
• Components:
– HTTP.sys
– Worker processes (W3wp.exe)
– ISAPI
– InetInfo.exe
– Application pools

7. HTTP.sys
• Also known as “HTTP Protocol Stack” or “Http
Listener Process”
• Implemented as a kernel-mode device driver
• core component to receive and serve HTTP
requests and passing them off to the worker
processes
• When you create a Web site, IIS registers the site
with HTTP.sys
• Other than retrieving a stored response from its
internal cache, HTTP.sys does not process the
requests that it receives.

8. W3wp.exe
• A worker process is user-mode code whose role is
to process requests, such as processing requests
to return a static page
• The worker process is controlled by the WWW
service
• A worker process runs as an executable file
named W3wp.exe
• Worker processes also run application code, such
as ASP.NET applications and XML Web services.

9. ISAPI
• Internet Server Application Programming
Interface, is an API developed to provide the
application developers with a powerful way to
extend the functionality of IIS
• Extensions and Filters are the two types of
applications that can be developed using ISAPI
• ISAPI extensions are true applications that run on
IIS and have access to all of the functionality
provided by IIS

10. ISAPI Extensions
• ISAPI extensions are implemented as DLLs that
are loaded into a process that is controlled by IIS
• Like ASP and HTML pages, IIS uses the virtual
location of the DLL file in the file system to map
the ISAPI extension
• ASP.Net functionality is contained in an ISAPI
extension called aspnet_isapi.dll
• Any file that is requested from the IIS server that
ends in “.aspx” is mapped to aspnet_isapi.dll
which is assigned to process the file before
displaying its output in the client’s window

11. ISAPI Filters
• ISAPI filters are DLL files that can be used to
modify and enhance the functionality provided
by IIS
• ISAPI filters always run on an IIS server, filtering
every request until they find one they need to
process
• Mostly used for Authentication and Encryption of
the i/p or o/p data for a site locally or all the
apps globally

12. InetInfo.exe
• A user-mode component that hosts the IIS
metabase and that also hosts the non-Web
services like the FTP, SMTP etc
• Used to manage ISAPI applications that run
within the IIS process context
• The services that run in Inetinfo.exe run as
dynamic-link libraries (DLLs) under the Local
System account
• In IIS5.0 or IIS6.0 runs in IIS5.0 isolation mode
>Inetinfo.exe hosts the worker process

13. Application Pools
• Group of Web Applications and Web Sites are
called Application Pools
• Every application within an application pool
shares the same worker process
• The worker process(w3wp.exe) that services one
application pool is separated from the worker
process that services another
• Each separate worker process provides a process
boundary so each application pool is separated
by these process boundaries

14. IIS Different Modes of
Operations
• IIS 5.0 isolation mode
(InetInfo.exe takes the ownership for request
processing)
• IIS 6.0 worker process isolation mode
(worker process W3wp.exe takes the ownership for
request processing)

15. Request Processing
• A request arrives. If the requested application is running in-
process, then Inetinfo.exe takes the request. If not, then
DLLHost.exe takes the request.
• Inetinfo.exe or DLLHost.exe determines if the request is valid.
If the request is not valid, it sends a code for an invalid request
back to the client.
• If the request is valid, Inetinfo.exe or DLLHost.exe checks to
see if the response is located in the IIS cache.
• If the response is in the cache, it is returned immediately.
• If the response is not cached, Inetinfo.exe or DLLHost.exe
processes the request, by evaluating the URL to determine if
the request is for static (HTML), or dynamic content (ASP)
• The response is sent back to the client and the request is
logged, if IIS is configured to do so.

16. IIS 6.0 Isolation Mode

17. Request Processing
• A request arrives at HTTP.sys.
• HTTP.sys determines if the request is valid. If the request is not
valid, it sends a code for an invalid request back to the client.
• If the request is valid, HTTP.sys checks to see if the request is
for static content (HTML) because static content can be served
immediately.
• If the request is for dynamic content, HTTP.sys checks to see if
the response is located in its “kernel-mode cache”.
• If the response is in the cache, HTTP.sys returns the response
immediately.
• If the response is not cached, HTTP.sys determines the correct
“request queue”, and places the request in that queue.

18. Request Processing
• If the queue has no worker processes assigned to it, HTTP.sys
signals the WWW service to start one.
• The worker process pulls the request from the queue and
processes the request, evaluating the URL to determine the
type of request (ASP, ISAPI, or CGI).
• The worker process sends the response back to HTTP.sys.
• HTTP.sys sends the response back to the client and logs the
request, if configured to do so.

19. Take Away