“Understanding our IIS”

Contents
 Web Server
 Kernel & User mode
 IIS and it's main components
 Different Modes of Operations
 Request Processing
 Take Away
 Web Server
• The primary function of a web server is to
deliver web pages on requests from clients using
HTTP.
• It can be referred as hardware(computer) or the
software (computer application)
• Hosts websites/web application to serve www.
• Found embedded in devices like printers,
routers, web-cams to serve local network
• Able to map URL to a local file system resource
(static requests) as well as internal or external
program name (dynamic requests)
 Kernel & User Mode
• The executing code • The executing code
has complete and has no ability to
unrestricted access directly access
to the underlying hardware or
hardware. reference memory.
• Kernel mode is • Code running in user
generally reserved mode must delegate
for the lowest-level, to system APIs to
most trusted access hardware or
functions of the memory.
operating system.
 Kernel & User Mode
• Crashes in kernel • Crashes in user mode
mode are are always
catastrophic; they recoverable.
will halt the entire
PC.
• Comparatively slow
• Usually work faster, as they have to ask
because, as part of the system the
the system, it can permission to use
directly use all the more memory or
hardware resources more CPU resources.
it needs.
 IIS main components
• Designed to provide secure, scalable solutions for
creating and managing www sites and servers
• We can publish information on intranets,
extranets and the internet
• Provides FTP, SMTP, Indexing and other services
• Components:
– HTTP.sys
– Worker processes (W3wp.exe)
– ISAPI
– InetInfo.exe
– Application pools
 HTTP.sys
• Also known as “HTTP Protocol Stack” or “Http
Listener Process”
• Implemented as a kernel-mode device driver
• core component to receive and serve HTTP
requests and passing them off to the worker
processes
• When you create a Web site, IIS registers the site
with HTTP.sys
• Other than retrieving a stored response from its
internal cache, HTTP.sys does not process the
requests that it receives.
 W3wp.exe
• A worker process is user-mode code whose role is
to process requests, such as processing requests
to return a static page
• The worker process is controlled by the WWW
service
• A worker process runs as an executable file
named W3wp.exe
• Worker processes also run application code, such
as ASP.NET applications and XML Web services.
 ISAPI
• Internet Server Application Programming
Interface, is an API developed to provide the
application developers with a powerful way to
extend the functionality of IIS
• Extensions and Filters are the two types of
applications that can be developed using ISAPI
• ISAPI extensions are true applications that run on
IIS and have access to all of the functionality
provided by IIS
 ISAPI Extensions
• ISAPI extensions are implemented as DLLs that
are loaded into a process that is controlled by IIS
• Like ASP and HTML pages, IIS uses the virtual
location of the DLL file in the file system to map
the ISAPI extension
• ASP.Net functionality is contained in an ISAPI
extension called aspnet_isapi.dll
• Any file that is requested from the IIS server that
ends in “.aspx” is mapped to aspnet_isapi.dll
which is assigned to process the file before
displaying its output in the client’s window
 ISAPI Filters
• ISAPI filters are DLL files that can be used to
modify and enhance the functionality provided
by IIS
• ISAPI filters always run on an IIS server, filtering
every request until they find one they need to
process
• Mostly used for Authentication and Encryption of
the i/p or o/p data for a site locally or all the
apps globally
 InetInfo.exe
• A user-mode component that hosts the IIS
metabase and that also hosts the non-Web
services like the FTP, SMTP etc
• Used to manage ISAPI applications that run
within the IIS process context
• The services that run in Inetinfo.exe run as
dynamic-link libraries (DLLs) under the Local
System account
• In IIS5.0 or IIS6.0 runs in IIS5.0 isolation mode
>Inetinfo.exe hosts the worker process
 Application Pools
• Group of Web Applications and Web Sites are
called Application Pools
• Every application within an application pool
shares the same worker process
• The worker process(w3wp.exe) that services one
application pool is separated from the worker
process that services another
• Each separate worker process provides a process
boundary so each application pool is separated
by these process boundaries
 IIS Different Modes of
Operations
• IIS 5.0 isolation mode
(InetInfo.exe takes the ownership for request
processing)

• IIS 6.0 worker process isolation mode

(worker process W3wp.exe takes the ownership for
request processing)
 Request Processing
• A request arrives. If the requested application is running in-
process, then Inetinfo.exe takes the request. If not, then
DLLHost.exe takes the request.
• Inetinfo.exe or DLLHost.exe determines if the request is valid.
If the request is not valid, it sends a code for an invalid request
back to the client.
• If the request is valid, Inetinfo.exe or DLLHost.exe checks to
see if the response is located in the IIS cache.
• If the response is in the cache, it is returned immediately.
• If the response is not cached, Inetinfo.exe or DLLHost.exe
processes the request, by evaluating the URL to determine if
the request is for static (HTML), or dynamic content (ASP)
• The response is sent back to the client and the request is
logged, if IIS is configured to do so.
IIS 6.0 Isolation Mode
 Request Processing
• A request arrives at HTTP.sys.
• HTTP.sys determines if the request is valid. If the request is not
valid, it sends a code for an invalid request back to the client.
• If the request is valid, HTTP.sys checks to see if the request is
for static content (HTML) because static content can be served
immediately.
• If the request is for dynamic content, HTTP.sys checks to see if
the response is located in its “kernel-mode cache”.
• If the response is in the cache, HTTP.sys returns the response
immediately.
• If the response is not cached, HTTP.sys determines the correct
“request queue”, and places the request in that queue.
 Request Processing
• If the queue has no worker processes assigned to it, HTTP.sys
signals the WWW service to start one.
• The worker process pulls the request from the queue and
processes the request, evaluating the URL to determine the
type of request (ASP, ISAPI, or CGI).
• The worker process sends the response back to HTTP.sys.
• HTTP.sys sends the response back to the client and logs the
request, if configured to do so.
Take Away