Figured this out just last week, but I can't find it now. Even printed it out. Can't find that either. Frustrating...so...help!
Configured a 'monitoring' nic on a kvm guest (running 'Security Onion, if it matters). I read (somewhere) that the default nic configuration for a kvm guest is to only pass broadcast traffic, multicast traffic, and traffic with the guest's mac as a destination. There is an option to override this behaviour, and pass all traffic. It's something like --mac-filtering=no, or --mac-restriction=no, or something like that. Worked beautifully.
Does this look at all familiar to anyone who can clue me in to the exact option syntax?