Linux – what are commands for tc shaping,queueing and scheduling

I asked this question on IRC and it appears that macvtap

injects guest traffic into the network stack too low for that

The solution is then to add a network interface for the guest and the host to communicate, or stay with the old bridged solution...

All ssh login attempts should be logged in /var/log/auth.log, examining that file may help you find those remote machines.