I was reading a Hacker News thread where one user posts a link from 2011 explaining that IIS is much faster than most other (*nix) web servers. Another user replies, explaining that IIS gets that advantage by having a kernel module called HTTP.sys. To my knowledge, most other popular web servers in 2015 do not do this.

I would never want to write a kernel mode web server, because I could never trust myself to make it free of security exploits (which would be less serious running in a lower protection ring).

From the perspective of the software engineer (as opposed to a customer for web servers), is running in kernel mode a smart performance decision? Can security concerns be mitigated in application development to the point of making a kernel mode server a net profit for the consumer?

  • 7
    "Server Fault is a question and answer site for system and network administrators." Sysadmins and network administrators do not write web servers; they install and maintain them. I think the question of kernel mode / user mode is much more relevant at development time than installation time. I don't mind having the question moved somewhere more relevant, but I feel like Server Fault won't find it on topic either. Commented Jan 22, 2015 at 6:48
  • Ok, rereading the question again, I guess it can be interpreted as a general software architecture question, and not as a question about the pros and cons of existing web servers, so retracted my close vote. But you might consider to edit your question to highlight the general software architecture aspect.
    – Doc Brown
    Commented Jan 22, 2015 at 6:55
  • 2
    Anyone who thinks that kernel mode web server could improve performance since it doesn't have to context switch should read: Latency numbers every programmers should know. Full context switch in Linux costs around 3000ns (source), but many syscalls doesn't actually need full context switch and can go as low as 50ns, I don't have numbers for Windows. This is somewhere along the 2nd/3rd column. Conclusion: minimize network request and disk, don't worry about context switches.
    – Lie Ryan
    Commented Jan 23, 2015 at 0:27

3 Answers 3


Http.sys is not so much a web server as a proxy-forwarder. Its designed to allow many web servers co-exist on a Windows box, so you can have IIS running a web site, but also several WCF services running with http/REST or SOAP interfaces, all on standard port 80. (this is why you can't run Apache on Windows without a bit of jiggling, Apache hasn't been modified to work with this registration system, shame it wasn't made more transparent to applications and require some quite complex modifications to hook into it).

The way it works is that you register a URL with it and the corresponding application, ans when a http request is made on port 80, http.sys accepts it but then passes the request on to whichever application is registered to handle that URL target.

I doubt a kernel mode webserver makes any sense - even if socket performance can be improved in this way, in order to perform any useful work, the application logic is still going to be executed in user space, so there's always a transition - you've just shifted it along the callstack a little.

  • 11
    The primary benefit of a full server in kernel mode is in serving static files: this can be done without a switch to user mode. Cacheing is also possible.
    – Jules
    Commented Jan 22, 2015 at 9:41
  • 3
    I think HTTP.sys is from a time where CPU cycles were a lot more scarce... Even when serving small static files (which is the most advantageous case for HTTP.sys) a fully user mode HTTP server would probably max out most networks.
    – usr
    Commented Jan 22, 2015 at 15:21
  • 4
    @usr Http.sys is a relatively new thing, introduced in Windows Server 2003. I'm pretty sure its there so you can run many web API services listening on port 80 simultaneously.
    – gbjbaanb
    Commented Jan 22, 2015 at 17:29
  • 2
    @gbjbaanb a user mode server could allow for that, too. Windows has the ability to share memory (for buffers) and to pass a socket handle to a different process.
    – usr
    Commented Jan 22, 2015 at 17:37
  • 1
    @JamesMishra In my mind, yes. Back then CPUs probably were >10x less powerful. Also, the security mindset wasn't really there. Today it's just a bad call.
    – usr
    Commented Jan 22, 2015 at 18:42

Http.sys is not the only kernel-mode web server available: under Linux there is also tux. As you have correctly identified, security is a concern with these kinds of servers, which has lead to tux not being included in the mainline linux kernel (and I believe not updated for more recent kernel versions).

A better solution would be the use of an operating system that does not rely on hardware protection to enforce process security, e.g. Microsoft's singularity: such a system would allow the efficiency gains of a kernel mode server without the security risks. Unfortunately, no production ready operating systems based on this principle are available as of 2015, and AFAIK nobody is seriously working on one either (the Singularity project was canceled).

  • The big problem with the Singularity approach is that it means that a but in the JITter can easily lead to privilege escalation. Commented Jan 22, 2015 at 11:57
  • 2
    The Tux Wikipedia article is an interesting read. Tux can forward HTTP requests for non-static content to a "real" web server like Apache, which sounds like what Http.sys is used for. I can't tell if Tux was as performant as Http.sys, but based from what little I read, it sounds like the Linux kernel devs would disagree sharply with Microsoft's decision. Commented Jan 22, 2015 at 18:37

Http.sys is low risk, as it can’t run any code provided by a third-party.

Http.sys does a few tasks:

  • It acts as a proxy-forwarder, so allowing multiple processes to respond to request to different parts of the HTTP name space. @gbjbaanb's answer covers this well.

  • It serves static files, directly from the Windows files cache. This provides a great speedup for small files static files, as there are no context switches.

  • It will cache the output from any application it forward a HTTP request to, and return the cashed result. The application is in complete control over how long (if any) the caching lasts.

Http.sys is designed to do the simple tasks VERY fast, while passing everything else to a process in user space.

In response to the comment

"low risk, as it can’t run any code provided by a 3rd party" - That's what they always say, and it's almost never true.

The issue is that you must trust Microsoft to write complex kernel code to be asking this question, otherwise you decide not to use Windows for web hosting at all. Http.sys adds very little to the risk of kernel bugs, given how complex the kernel is anyway.

If anything Http.sys reduces the risk, as there is such a clear separation below “low level” web serving and application code.

In a well designed setup, the machine (or virtual server) that runs the web server has very limited access to the rest of the network, as it is a high risk target. It makes very little different if the kernel or a user mode web server is hacked, as the server should not have any more “rights” on the network, then the web-server user mode process needs to do its work.

  • 1
    Usermode applications are often written in typesafe languages which rules out most memory corruption based bugs (these are typically those that lead to remote code execution). Commented Jan 22, 2015 at 16:18
  • 4
    I'm not sure if I buy the argument that if I trust Microsoft to write kernel code, that it is a small jump to trust them to write kernel mode web server code. I am fairly naive from an information security perspective, but I imagine it would be far easier to weaponize a buffer overflow in Http.sys than in a device driver or some other part of the kernel further away from the Internet. Commented Jan 22, 2015 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.