libvirt users - May 2010 - How to prevent IP-spoofing/traffic sniffing by the guest machines? (KVM)

Hi,

In a libvirt/KVM setup, what is the best way to prevent untrusted guest 
machines from (a) sending packets with a sender address different from their 
own and (b) reading packets not intended for them?

Note that guests may have any number of IP addresses they are allowed to use 
legitimately.

        Guido