Why IIS6 only loads 49 ISAPI Filters



i have 52 sites in IIS6 running on 1 application pool and im trying to install an ISAPI filter for eache site (each site has it’s actual phisycal DLL). the installation works OK but when restarting the IIS only 49 sites work and i get an error on the other 3 sites “Could not load all ISAPI filters for site/service. Therefore startup aborted.” with data value 32. also looking in process explorer i see that w3wp only load 49 DLL’s (if i add a different DLL to one of the sites only 48 DLL’s are loaded). any ideas about this issue?



I have to thank you for asking this question.

During IIS6 development, I had identified and pointed out this potential problem to the developer during code review, but the developer did not want to fix it without me coming up with a real customer scenario other than “the problem can happen”… and here you are with a scenario. 🙂

The problem here is that IIS6 Server Core has a fixed length list of 50 (I had wanted a dynamically growing list) for the total number of filters merged between global and per-site, and as administrator you can actually DoS your server if you configure 50 or more filters (as you have discovered). Yes, it is a DoS by administrator configuration, hence it is not a security issue because administrators can DoS a server in so many other ways, such as shutting off the power, stopping IIS, deleting files, etc. But, I still think the “limitation” is lame.

So… there is no work-around other than to do whatever you want to accomplish with less than 50 ISAPI Filters. If you need per-site configuration outside of using GetFilterVersion with a site filter, you can read and cache the lookup table in GetFilterVersion and then multiplex in HttpFilterVersion based on URL or Host: header.


Comments (2)

  1. Wow, this is unbelievable and I assumed you have manage to push it in dynamic with IIS 7. If not, then it is not so ‘exensible’ 🙂

  2. David Wang says:

    Bernard – Well… we are actually talking about the behavior of the ISAPI Filter module in IIS7 and not exactly the extensibility of IIS7 Server Core. In fact, IIS7 core does not even know about ISAPI Filters – it only knows the new HTTP Module API and ISAPI Filter module shims things on top of it.

    In other words, if you don’t like the limit, you can reimplement the ISAPI Filter Module and remove the limit. Extensibility is definintely preserved. 🙂 Of course, it also requires you to implement everything *else* about ISAPI Filter, which may not be that easy…

    I went and checked the source code and sure enough, the ISAPI Filter module in IIS7 also has a max of 50. I’m going to have fun pushing this change through again…