THE INSPECT ENGINE

When installed on a gateway,the FireWall-1 INSPECT Engine controls traffic
passing between networks. The INSPECT Engine is dynamically loaded into the
operating system kernel, between the Data Link and the Network layers (layers 2 and 3). Since the data link is the actual network interface card (NIC) and the network link is the fi rst layer of the protocol stack (for example, IP), FireWall-1 is positioned at the lowest software layer. By inspecting at this layer, FireWall-1 ensures that the INSPECT Engine intercepts and inspects all inbound and outbound packets on all interfaces. No packet is processed by any of the higher protocol stack layers, no matter what protocol or application the packet uses, unless the INSPECT Engine fi rst verifi es that the packet complies with the
security policy.

Ref - www.checkpoint.com