It works by simply sending false responses to the client making him think he's got a live one. While you keep him amused with some worthless data you can easily trace him and have him cut off before he realises he's suddenly become a victim. Some will get wise before you can do anything about it, of course, but just as many fall for it - most likely newbies. The point is that the longer you can keep them occupied, the easier it is to trace them. Not everyone is so stupid, but you'd be surprised.
Most attacks come from bairns too stupid to know any better, but feel no mercy.
When it finds a crack in your armour, consult the site's lucid documentation for resolutions. If you come up clean, congratulations, but note that the site only checks 10 of the 65,536 ports available. If all is well, you'll get a report similar to the following. Port 110 is the POP3 port and, if you have Norton AntiVirus E-nmail Protection enabled, you'll likely find this port Closed, rather than Stealthed, even with AtGuard's firewall in place. AtGuard itself is no longer available but the technology it employed is now incorporated into Norton Internet Security 2000.