Ownership of HTTP Connections
Why are all of the TCP sockets for my HTTP application owned by PID 4?
The "-o" option of netstat tells you the process ID associated with each of the network connections. If you look at the process owner for an HTTP client application, then you should see the PID of your client application. If you look at the process owner for an HTTP server application on Windows Vista, then you'll see PID 4.
PID 4 is the process identifier of the System process. When Windows 2003 came out, it introduced the http.sys driver that handles HTTP communication as a kernel-mode service. In this case, WCF is using http.sys to do the listening, so http.sys is the process owner that shows up for the connection. This is why everything appears to be coming from the System process.
Next time: A Bit More on Call Context Initializers
Comments
Anonymous
April 25, 2007
What is the lifetime of a TCP session? The lifetime of the session object from a TCP transport channelAnonymous
April 26, 2007
The comment has been removedAnonymous
April 29, 2007
http.sys doesn't actually do any request processing in the kernel. It routes the incoming requests to a user-mode request queue. Among other things, this lets multiple HTTP applications share the same port.