Haystack hides traffic to any from the internet at large inside traffic that looks like perfectly normal web connections to innocuous sites. I don't get it. Ho

Haystack hides traffic to any from the internet at large inside traffic that looks like perfectly normal web connections to innocuous sites. I don't get it. How is "hiding" this traffic amongst other innocuous traffic going to defeat, say, ngrep looking for connection to the haystack servers. At some point you're going to have a tcp connection from client to haystack server...