A regular identd on a masquerading firewall will return an error for requests concerning a masqueraded connection. Midentd solves this problem. When a request comes in, it checks it in /proc/net/tcp first, just like any regular identd will do. If it can't find the connection there, it looks in /proc/net/ip_conntrack and tries to find it there. If it does, it will connect to the client that owns the connection and ask the midentd there which user owns that connection. If midentd isn't running on the client, it will try a normal ident request.

When the client that initiated the masqueraded connection doesn't run an identd or the connection times out, a faked reply will be generated.