To scan a host downstream from a security gateway, Firewalking:

Sends a UDP-based packet that it knows will be blocked by the firewall to determine how specifically the firewall responds to such packets

Uses the TTL function to send packets with a TTL value set to expire one hop past the identified security gateway

Sends an ICMP ''administratively prohibited'' packet to determine if the gateway will drop the packet without comment.

Assesses the security rules that relate to the target system before it sends packets to any hops on the route to the gateway