@attrc You're right-- attacker needs to be in same collision domain with external NIC of target host. More of a pivoting tactic.