IIS Architecture

Question

IIS Architecture

Nicola Sergio 80

Looking at the official Microsoft Documentation, be more accurate the IIS architecture diagram, it isn't clear how external requests reach the w3wp process.

Does w3wp process takes request from a queue in kernel space? Or the transmission of request happens in user-space from WAS to w3wp?

I thank you in advance

0 comments

Answer accepted by question author

2 additional answers

Your answer

Answer 1

Hi @Nicola Sergio ,

Does w3wp.exe pull requests from HTTP.sys request queue through a syscall? Or does HTTP.sys push the request from the queue to the process?

It’s a pull model.

HTTP.sys receives incoming HTTP requests and places them into a request queue, then passes them to IIS for processing.

The worker process (w3wp.exe) retrieves requests from its assigned queue. HTTP.sys does not push requests into the process.

In the pull model, how does the process pull requests headed to it?

Each application pool has its own request queue inside HTTP.sys, and requests are routed to the correct queue based on the configuration.

When a worker process starts, it is given a handle to its queue.

Worker threads in w3wp.exe issue receive calls against that queue. These calls either block until a request is available or complete asynchronously when a request arrives.

At the HTTP API level, this is exposed through functions like HttpReceiveHttpRequest, which retrieves the next available request from the specified queue.

Does this involve a syscall between user mode and kernel mode?

Yes.

The worker process runs in user mode and calls into the HTTP API, which transitions into kernel mode to communicate with HTTP.sys and retrieve the request.

So in short:

HTTP.sys (kernel) receives and queues requests
WAS manages processes but does not forward requests
w3wp.exe (user mode) pulls requests from its queue using blocking or async calls
there is no push from HTTP.sys into the worker process

Answer 2

Tom Tran (WICLOUD CORPORATION) 4,860 Microsoft External Staff Moderator

Hi @Nicola Sergio ,

The diagram in the documentation is simplified so this part can look unclear.

For HTTP/HTTPS requests, the request first reaches HTTP.sys, which is the Windows kernel-mode HTTP listener. HTTP.sys places the request into the appropriate request queue, and the worker process w3wp.exe processes requests from that queue.

So the simplified flow is:

Client -> HTTP.sys -> HTTP.sys request queue -> w3wp.exe -> HTTP.sys -> Client

WAS is still involved, but it does not pass the actual HTTP request to w3wp.exe. Its role is to manage application pool configuration and worker processes, including starting w3wp.exe when needed.

So the short answer is: yes, w3wp.exe processes the request from the HTTP.sys queue. The request is not transmitted from WAS to w3wp.exe as a user-mode handoff.

If you found my response helpful or informative, I would greatly appreciate it if you could follow this guidance provide feedback. Thank you.

Nicola Sergio 80 Reputation points

2026-04-30T13:56:17.3566667+00:00

But is the proces "w3wp.exe" that pull requests from HTTP.sys request queue through a syscall? Or http.sys push the request from queue to the process? And in the first one case, how the process pull requests headed to it? @Tom Tran (WICLOUD CORPORATION)
Tom Tran (WICLOUD CORPORATION) 4,860 Reputation points Microsoft External Staff Moderator

2026-05-01T08:27:50.7033333+00:00

Hi @Nicola Sergio ,

Thanks for the follow up questions.

But is the process "w3wp.exe" that pulls requests from HTTP.sys request queue through a syscall? Or HTTP.sys pushes the request from queue to the process?

It's a pull model. The worker process (w3wp.exe) actively calls into HTTP.sys to retrieve requests, HTTP.sys does not push them into the process.

The function behind this is HttpReceiveHttpRequest. The worker process calls it with a handle to its request queue, and the call either blocks until a request arrives or uses asynchronous I/O so threads aren't sitting idle. The Processing Requests page puts it simply: "The application calls the HttpReceiveHttpRequest function to receive the request."

This call goes through httpapi.dll, which transitions into kernel mode to talk to HTTP.sys, so yes, a syscall is involved.

And in the first case, how does the process pull requests headed to it?

Each application pool has its own request queue inside HTTP.sys, with specific URL prefixes registered to it. When a request comes in, HTTP.sys matches the URL and drops it into the right queue. When WAS starts a worker process, it gives that process a handle to its queue, so the worker only ever pulls requests that belong to its app pool.
Nicola Sergio 80 Reputation points

2026-05-02T00:21:33.2033333+00:00

@Tom Tran (WICLOUD CORPORATION) If you include this details in the first one answer I would be glad to accept your answer.

Answer 3

External HTTP/HTTPS requests reach w3wp.exe through a kernel-mode queue managed by HTTP.sys; they are not transmitted from WAS to w3wp in user space.

The flow, based on the IIS architecture, is:

A client sends an HTTP(S) request.
The kernel-mode HTTP.sys driver (the HTTP stack) receives the request as the protocol listener.
- HTTP.sys provides kernel-mode request queuing and pre-processing.
HTTP.sys contacts the Windows Process Activation Service (WAS) to obtain configuration from applicationHost.config and to determine the correct application pool.
WAS starts the worker process (w3wp.exe) for that application pool if it is not already running.
The World Wide Web Publishing Service (WWW Service / W3SVC) acts as the listener adapter for HTTP.sys and configures HTTP.sys, including the request queues.
HTTP.sys forwards queued requests directly from kernel mode to the appropriate worker process (w3wp.exe) associated with the application pool.
Inside w3wp.exe, the Web Server Core and its native/managed modules process the request and generate a response.
The response is returned from w3wp.exe to HTTP.sys, which then sends it back to the client.

Key points for the specific questions:

Does w3wp take requests from a queue in kernel space?
- Yes. HTTP.sys maintains kernel-mode request queues. Requests are queued in kernel mode and then dispatched directly to the correct worker process (w3wp.exe).
Does WAS transmit the request in user space to w3wp?
- No. WAS is responsible for process and application activation (starting and managing worker processes) and for providing configuration. It does not carry the HTTP request payload from client to w3wp. The actual request data path is HTTP.sys (kernel) → w3wp.exe (user), using the kernel-mode request queue.

WAS and WWW Service provide configuration and activation, while HTTP.sys handles listening, kernel-mode queuing, and delivery of requests to w3wp.exe.

References:

Share via

IIS Architecture

2 additional answers

Your answer