VM2 (right) is trying to open an HTTP connection with the gateway at port 80 and this shows up on the attackers machine (VM1 on the left)