this is good for now, but later on we would like to include the initial telnet negotiation phase - else an experienced attacker would be able to fingerprint the honeypot passively.