ATRs should probably be treated differently? Also, is there a performance penalty when using scapy instead of holding a connection open?