Every filter is contained in a separate DLL with two common entry point functions, GetFilterVersion and HttpFilterProc. When the DLL is loaded, GetFilterVersion is called. When the GetFilterVersion entry point is called, it passes an HTTP_FILTER_VERSION structure to the filter. The filter uses this structure to provide IIS with version information, a list of the events that the filter should be informed of, and the priority level for each event.
After this first exchange, every time IIS processes one of the available events, it calls any filters that have registered for that event. If several filters have registered for the same event, the filters are called sequentially. The order that IIS calls the filters depends first on the priority specified in the dwFlags member of the HTTP_FILTER_VERSION structure by GetFilterVersion. If two or more different filters have registered for the same event at the same priority level, the order that the filters were loaded determines the order in which they are called. You can configure the order that filters are loaded by using the metabase. The order in which events are processed is described in detail in Summary of Event Ordering.
When the HttpFilterProc entry point is called, the filter uses the notificationType parameter to determine what action to take. For example, a filter that encrypts data will probably register for events that read or write raw data. When the filter receives notification that a read or write event has occurred, it encrypts the data and uses the WriteClient callback function to write the encrypted data to the client.