The document provides an overview of Microsoft's Internet Information Services (IIS), detailing its primary function as a web server that delivers web pages. It elaborates on key components, including the web server's architecture, kernel & user modes, request processing, and main components such as http.sys, worker processes, and ISAPI. Additionally, the document discusses different IIS versions and their operational modes, emphasizing how requests are processed and managed within this framework.

1. “Understanding our IIS”

2. Contents
 Web Server
 Kernel & User mode
 IIS and it's main components
 Different Modes of Operations
 Request Processing
 Take Away

3. Web Server
• The primary function of a web server is to
deliver web pages on requests from clients using
HTTP.
• It can be referred as hardware(computer) or the
software (computer application)
• Hosts websites/web application to serve www.
• Found embedded in devices like printers,
routers, web-cams to serve local network
• Able to map URL to a local file system resource
(static requests) as well as internal or external
program name (dynamic requests)

4. Kernel & User Mode
• The executing code
has complete and
unrestricted access
to the underlying
hardware.
• Kernel mode is
generally reserved
for the lowest-level,
most trusted
functions of the
operating system.
• The executing code
has no ability to
directly access
hardware or
reference memory.
• Code running in user
mode must delegate
to system APIs to
access hardware or
memory.

5. Kernel & User Mode
• Crashes in kernel
mode are
catastrophic; they
will halt the entire
PC.
• Usually work faster,
because, as part of
the system, it can
directly use all the
hardware resources
it needs.
• Crashes in user mode
are always
recoverable.
• Comparatively slow
as they have to ask
the system the
permission to use
more memory or
more CPU resources.

6. IIS main components
• Designed to provide secure, scalable solutions for
creating and managing www sites and servers
• We can publish information on intranets,
extranets and the internet
• Provides FTP, SMTP, Indexing and other services
• Components:
– HTTP.sys
– Worker processes (W3wp.exe)
– ISAPI
– InetInfo.exe
– Application pools

7. HTTP.sys
• Also known as “HTTP Protocol Stack” or “Http
Listener Process”
• Implemented as a kernel-mode device driver
• core component to receive and serve HTTP
requests and passing them off to the worker
processes
• When you create a Web site, IIS registers the site
with HTTP.sys
• Other than retrieving a stored response from its
internal cache, HTTP.sys does not process the
requests that it receives.

8. W3wp.exe
• A worker process is user-mode code whose role is
to process requests, such as processing requests
to return a static page
• The worker process is controlled by the WWW
service
• A worker process runs as an executable file
named W3wp.exe
• Worker processes also run application code, such
as ASP.NET applications and XML Web services.

9. ISAPI
• Internet Server Application Programming
Interface, is an API developed to provide the
application developers with a powerful way to
extend the functionality of IIS
• Extensions and Filters are the two types of
applications that can be developed using ISAPI
• ISAPI extensions are true applications that run on
IIS and have access to all of the functionality
provided by IIS

10. ISAPI Extensions
• ISAPI extensions are implemented as DLLs that
are loaded into a process that is controlled by IIS
• Like ASP and HTML pages, IIS uses the virtual
location of the DLL file in the file system to map
the ISAPI extension
• ASP.Net functionality is contained in an ISAPI
extension called aspnet_isapi.dll
• Any file that is requested from the IIS server that
ends in “.aspx” is mapped to aspnet_isapi.dll
which is assigned to process the file before
displaying its output in the client’s window

11. ISAPI Filters
• ISAPI filters are DLL files that can be used to
modify and enhance the functionality provided
by IIS
• ISAPI filters always run on an IIS server, filtering
every request until they find one they need to
process
• Mostly used for Authentication and Encryption of
the i/p or o/p data for a site locally or all the
apps globally

12. InetInfo.exe
• A user-mode component that hosts the IIS
metabase and that also hosts the non-Web
services like the FTP, SMTP etc
• Used to manage ISAPI applications that run
within the IIS process context
• The services that run in Inetinfo.exe run as
dynamic-link libraries (DLLs) under the Local
System account
• In IIS5.0 or IIS6.0 runs in IIS5.0 isolation mode
>Inetinfo.exe hosts the worker process

13. Application Pools
• Group of Web Applications and Web Sites are
called Application Pools
• Every application within an application pool
shares the same worker process
• The worker process(w3wp.exe) that services one
application pool is separated from the worker
process that services another
• Each separate worker process provides a process
boundary so each application pool is separated
by these process boundaries

14. IIS Different Modes of
Operations
• IIS 5.0 isolation mode
(InetInfo.exe takes the ownership for request
processing)
• IIS 6.0 worker process isolation mode
(worker process W3wp.exe takes the ownership for
request processing)

15. Request Processing
• A request arrives. If the requested application is running in-
process, then Inetinfo.exe takes the request. If not, then
DLLHost.exe takes the request.
• Inetinfo.exe or DLLHost.exe determines if the request is valid.
If the request is not valid, it sends a code for an invalid request
back to the client.
• If the request is valid, Inetinfo.exe or DLLHost.exe checks to
see if the response is located in the IIS cache.
• If the response is in the cache, it is returned immediately.
• If the response is not cached, Inetinfo.exe or DLLHost.exe
processes the request, by evaluating the URL to determine if
the request is for static (HTML), or dynamic content (ASP)
• The response is sent back to the client and the request is
logged, if IIS is configured to do so.

16. IIS 6.0 Isolation Mode

17. Request Processing
• A request arrives at HTTP.sys.
• HTTP.sys determines if the request is valid. If the request is not
valid, it sends a code for an invalid request back to the client.
• If the request is valid, HTTP.sys checks to see if the request is
for static content (HTML) because static content can be served
immediately.
• If the request is for dynamic content, HTTP.sys checks to see if
the response is located in its “kernel-mode cache”.
• If the response is in the cache, HTTP.sys returns the response
immediately.
• If the response is not cached, HTTP.sys determines the correct
“request queue”, and places the request in that queue.

18. Request Processing
• If the queue has no worker processes assigned to it, HTTP.sys
signals the WWW service to start one.
• The worker process pulls the request from the queue and
processes the request, evaluating the URL to determine the
type of request (ASP, ISAPI, or CGI).
• The worker process sends the response back to HTTP.sys.
• HTTP.sys sends the response back to the client and logs the
request, if configured to do so.

19. Take Away