[libvirt-users] How to prevent IP-spoofing/traffic sniffing by the guest machines? (KVM)

Hi, In a libvirt/KVM setup, what is the best way to prevent untrusted guest machines from (a) sending packets with a sender address different from their own and (b) reading packets not intended for them? Note that guests may have any number of IP addresses they are allowed to use legitimately. Guido