When embedding an encrypted stego message into a header field of network packets, then the symbol frequencies of normal traffic should be mimicked as best as possible. To this end, we propose an embedding that is based on an inverse Huffman encoding. Next to experimental results for real distributions of header field values we also discuss Huffman decoding in detail: the stego code should require low effort and low memory requirements to remain stealthy on the computer used by the covert sender. As those targets are in conflict, we propose to select from a set of Pareto-optimal decoder variants. To find those variants, we use a heuristic based on solving a Markov chain-model.