So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine.
In my lab I have lots of workstations, each running a VirtualBox with network adapter bridged to the host adapter (eth0 or wlan0). Each virtual machine has a malformed MAC and of course different IP addr (set statically or through DHCP).
When I analyze packages with tcpdump (or wireshark) I can't see any common points between hosts and particular VMs. But maybe I'm wrong?
Is there a way to find a host-machine based a traffic generated by VMs doing for example nmap scanning of my lab network?