title: how exactly does http.sys work
body: <p>I'm trying to get a deeper understanding of how IIS works.</p>
  
  <p>http.sys i understand is one its major components. However, i have been having trouble finding easily digestible information about it. I couldn't get a good mental model going until i heard about the WSK, then i think it all fell into place. </p>
  
  <p>From a lot of random googling a little experimentation this is my current high level understanding of why it exists and how it does it's stuff.</p>
  
  <p>Why: </p>
  
  <p>Port sharing, and higher performance caching.</p>
  
  <p>How:</p>
  
  <p>User mode processes use the WinSock api to open a socket listening on a port to gain access to the networking subsystem, e.g. tcp/ip. Kernal mode software like the http.sys driver uses Winsock Kernal Sockets (WSK) api to achieve the same end using the same pool of TCP port numbers as the WinSock api.</p>
  
  <p>IIS, a web service or anything that wants to use http registers itself with http.sys using a unique url/port combination. http.sys opens up a socket on this port using WSK (if it hasn't already for another url/port combination with the same port) and listens.</p>
  
  <p>When the transport layer (tcpip.sys) has reconstructed a load of ip packets back into an http request that a client sent it gives it to http.sys via the port in the request. Http.sys uses the url/port number to send it the the appropriate process which parses it however it pleases.</p>
  
  <p>I know it seems like I'm answering my own question but I'm really not that sure of myself on this and would like some closure so i can get on with more interesting things. </p>
  
  <p>Am i close?</p>