Now all packets go to the attacker (VM2) and are then forwarded to the gateway from there which means all the activities of VM2 can be captured, as shown in the following figure: