Protowall is a lightweight program that runs in the background, taking up little CPU and memory, while blocking thousands of "bad" IP addresses.

In Protowall, all the work is done by the driver that filters each packet, extracts the IP header and then compares the address with the ones in the table, then either discards or permits the packet to pass. The GUI is essentially a "driver instructor" that communicates to the driver the IP list to check against. The GUI also receives notifications from the driver when a packet arrives and when actions are performed with a packet. Protowall Blocks both inbound and outbound packets.

Protowall blocks incoming packets from Internet addresses that are on the Bluetack Blacklists. This is handled by another program called the Blocklist Manager. This program finds and retrieves lists of bad IP addresses. They are sorted (overlapping resolved) and then converted to various formats such as Protowall, PeerGuardian & other common applications and firewalls.