On HTTP.SYS..

In the past, HTTP Servers such as IIS, Apache, and other applications on Winodws, relied on the Winsock API running in User mode for creating what is known as a network listener.

When was HTTP.SYS introduced?
Starting with IIS6 on Windows Server 2003 SP1 and Windows XP SP2, Microsoft introduced a new HTTP listener. The HTTP listener is implemented as a kernel-mode device driver called the HTTP protocol stack (HTTP.sys). HTTP.sys is part of the networking subsystem of the Windows operating system, as a core component.

What’s good about Https.sys?
Robustness - Requests are processed faster because they are routed directly from the kernel to the appropriate user-mode worker process instead of being routed between two user-mode processes
Reliability - When a worker process fails, service is not interrupted; the failure is undetectable by the user because the kernel queues the requests while the WWW service starts a new worker process for that application pool.
Caching - static content is cached Kernel level providing even greater response
Logging Support - this is the IIS log capability that is now streamlined and faster, it is also text-based.
Bandwidth Control - It Implementes Quality of Service (QoS) functionality, which includes connection limits, connection timeouts, queue-length limits, and bandwidth throttling.
IP Port reuse - more than one application can listen on Port 80 - or any IP port leveraged within the Http.sys Kernel mode driver.

How does How HTTP.sys Works?
Once you create a new website or host a new WCF service in IIS , IIS registers the site/service with HTTP.sys, which then receives any HTTP requests for the site/service. HTTP.sys functions like a forwarder, sending the HTTP requests it receives to the request queue for the user-mode process that runs the Web site or the WCF service. HTTP.sys also sends responses back to the client.

While Http.sys retrieve stored responses from its internal cache, HTTP.sys does not process the requests that it receives. Therefore, no application-specific code is ever loaded into kernel mode. Which is good because bugs in application-specific code cannot affect the kernel or lead to system failures.

How to Configuring HTTP.SYS?
You can create the new DWORD values or modify them under the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
Which will be covered in details in another post.

Why does my website or http based WCF service stop responding sometimes in IIS 6 althought the application is started and the app pool is started, and no errors are being logged to the events log?

Most likely you have some kernal driver leaking non-paged pool (NPP) memory. HTTPS.SYS has a threshold for the minimum NPP memory free to use, if the available NPP is less than the required threshold HTTP.SYS stops responding. The easiest way to profile this issue is to check Httperr.log, the default location is: %WinDir%\system32\LogFiles\HTTPERR\
If you see something similar to this: Number_Connections_refused, that means that HTTP.SYS stopped responding because the avilable NPP fell below its minimum threshold.