Role of HTTP.SYS in IIS

The Hypertext Transfer Protocol (HTTP) listener is implemented as a kernel-mode device driver named HTTP.sys. HTTP.sys is part of the networking subsystem of Windows. However, HTTP.sys is utilized as a core component of IIS 6.0.
By running HTTP.sys as a kernel-mode component, IIS 6.0 delivers the following two performance enhancements, which are not included when running HTTP listener as a user-mode component:
• By dispatching directly to the correct process from the kernel, requests are served with less context-switching overhead.
• By enabling the kernel-mode cache, requests for cached returns can be served without switching to user mode.
How HTTP.sys Works
When you create a Web site in IIS, the site is registered with HTTP.sys, which then routes Web requests to the user-mode process that is running the Web site. HTTP.sys also sends responses back to the client. Other than retrieving a stored response from its internal cache, HTTP.sys does not process the requests it receives. Therefore, no application-specific code is ever loaded into kernel mode. As a result, application-specific code bugs cannot affect kernel-mode processes or lead to system failures.
HTTP.sys provides other services that IIS uses, including the following:
• Managing Transmission Control Protocol (TCP) connections.
• Routing HTTP requests to the correct request queue.
• Caching of responses in kernel mode.
• Performing all text-based logging for the WWW service.
• Implementing Quality of Service (QoS) functionality, which includes connection limits, connection time-outs, queue-length limits, and bandwidth throttling.

The role of http.sys is to route the HTTP requests to user mode applications. But it doesn’t process the request. It also caches the server’s response.