The option "CheckHostIP no" cancels ssh's lookup, but the ssh clinet still calls gss_import_name with the parameter GSS_C_NT_HOSTBASED_SERVICE. This call creates a name lookup internally (via gss's call to krb5_sname_to_principal).

This causes "ssh" to always attempt to backresolve IP addresses. It only gives up after about 10 seconds. This means that all ssh-based traffic (ssh, sftp, etc) requires a 10 second initiation time (!) before it can work, unless adding the private network IP addresses to /etc/hosts.

I think "ssh" is the last tool I have left that still insists on backresolving my private net IP's, and I would rather not pollute /etc/hosts with private addresses.