I believe you are correct in your understanding. Mine was a little different. I thought this was a classic asymmetrical routing scenario on the Internet with a

I believe you are correct in your understanding. Mine was a little different. I thought this was a classic asymmetrical routing scenario on the Internet with a cool eavesdropper twist. I'm assuming that because the sat system broadcasts unencrypted, you can sniff all the packets for all hosts on that network just like you can on a wifi network with the proper promiscuous mode receiver. An unencrypted shared broadcast medium. So packet flow is routed inbound from victim as such (victim SYN to decoy IP) to (internet) to (sat broadcast to geographic area decoy and attacker C&C) But packet flow outbound from C&C to victim is handled differently via landline (spoofed decoy IP) to (landline/internet) to (victim) So packets come in via sat link but go out via spoofed source on a landline.