<qemu:commandline>
<qemu:arg value='-netdev'/>
<qemu:arg value='socket,id=mynet0,listen=10.6.0.1:12200'/>
<qemu:arg value='-device'/>
<qemu:arg value='virtio-net-pci,netdev=mynet0,id=net1,mac=58:a4:c0:a8:bf:51,bus=pci.0,addr=0x3'/>
</qemu:commandline>
On the other endpoint, a Linux TAP tunnel daemon is responsible for encapsulating packet to the Length-Value data as the article said.In this way, I can create a L2 tunnel from remote site to the VM, also keep the VM untainted.