Interesting trying to tcpdump this; of course it basically explodes in reverse DNS queries. tcpdump -n is needed, but I wonder if this sort of behaviour could be exploited in some nasty/interesting way.