We can divide the whole architecture into two layers.

1.       User Mode

2.       Kernel Mode

Svchoost.exe

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”.

applicationHost.config:

ApplicationHost.config is the root file of the configuration system when you are using IIS 7 and above. It includes definitions of all sites, applications, virtual directories and application pools, as well as global defaults for the web server settings (similar to machine.config and the root web.config for .NET Framework settings).

Hypertext Transfer Protocol Stack (HTTP.sys)

The HTTP.sys is part of the networking subsystem of Windows operating systems, and it is implemented as a kernel-mode device driver called the HTTP protocol stack (HTTP.sys). HTTP.sys listens for HTTP requests from the network, passes the requests onto IIS for processing, and then returns processed responses to client browsers.

W3WP.exe:

It’s helpful to identify which of your application pools consumes the resources.

HTTP Request Processing in IIS7:

As per the below diagram, IIS7 has two modes, Kernel and User. HTTP.SYS is the heart of kernel mode which accepts raw requests from the client and passes it to a particular application pool. I am just explaining the processing of HTTP request in just eight steps, these are given below:

1.       When a client browser initiate an HTTP request for a resource on the Web server, HTTP.sys Intercept the request.

2.       HTTP.sys contacts were to get hold of information from the configuration store.

3.       Windows Activation Service request configuration information from the applicationHost.config file.

4.       World Wide Web Service receives configuration information, such as application pool and site configuration.

5.       World Wide Web Service uses the configuration information to configure HTTP.sys.

6.       Windows Activation Service starts worker process for the application pool to which the request was made.

7.       The worker process processes the request and returns a response to HTTP.sys.

8.       The client System receives a response.