On a local network, I thought about a way to know if a remote host acts as a gateway or not. In other words, it remotely probes the "/proc/sys/net/ip_forward" file content (used to enable or disable IP forwarding). It can be useful if you join an unfamiliar network and wish to find out what is the default gateway.
The trick is done by sending an ICMP_ECHOREQUEST packet to an arbitrary host, and by forging the destination MAC address of the MAC header with the MAC address of the remote target. Thus, the packet will be first handled by the target.
read more.........http://vladz.devzero.fr/007_isgate.php