I think it would be more clever to use an actual valid TCP connection and hide the data in the fragment sizes, timing, push flags, and other various legal flags

I think it would be more clever to use an actual valid TCP connection and hide the data in the fragment sizes, timing, push flags, and other various legal flags and options available. This doesn't let you mask your source, but it allows two way communication.