It sounds like the c&c server can detect any signal sent to the decoy host. So a TCP handshake might look like: Victim to decoy: syn CNC to victim posing as d

It sounds like the c&c server can detect any signal sent to the decoy host. So a TCP handshake might look like: Victim to decoy: syn CNC to victim posing as decoy, after reading sequence number from message 1: syn ack Victim to decoy: ack