The guest OS has an IP address of x.x.x.3 with a Default Gateway of x.x.x.1 . The host OS has an interface with IP address x.x.x.2. If I sniff that interface, I can see only ARP requests for x.x.x.3 and x.x.x.1, netbios, and mdns traffic -- no other traffic. I can see the other traffic outbound from the host OS on the host OS's regular NIC, but already NAT'd. Where do the packets destined for x.x.x.1 go before they lose the source IP of x.x.x.3? Is the x.x.x.1 IP address handled in software (i.e. without an actual interface)? -- Does the pvsnatd respond to x.x.x.1? I want to examine the pre-NAT'd traffic from *outside* the VM. Is this possible? Thanks. (This is with Shared Networking, in case that wasn't clear...)