difference between kernel mode and user mode caching in IIS 8.0

Kernal Mode caching is essentially going to handle caching requests at the OS-level, so contents that are stored in it can be accessed without ever going down the rest of the usual pipeline (i.e. it will not have to go down to the ASP.NET or IIS-level caches to check for the contents) :

So the request hits the initial cache (http.sys), finds what it needs and sends it back, all without ever having to proceed further down the pipeline.

As a the result of this, it's usually quite fast. A limitation of it however is that it does not support many user-level features such as authentication and authorization, so it may not fit all scenarios.

User-mode on the other hand is going to fill in the gaps where Kernal-mode cannot be used, which primarily surrounds authorized/authenticated content (as it requires a check to see if the user can actually access the contents), but there are many other scenarios that could cause the http.sys cache to not be used.

With regards to actually checking to see if content is or is not being cached (and possibly why), you can use FREB (Failed Request Event Buffering). The following command can be used to find out which content is cached in kernel mode:

netsh http show cachestate