Well, the DNS response packets would suffice as well.... actually that would be a lot more helpful now that I think of it. ^.^

I would need to see some of that information if I were to make any sort of discernible judgment on the situation though >.<