What OP really needs to do is get tcpdump (or similar) output from the vm, and just outside the vm (host or router).