Snow Leopard running Fusion has virtual ports invisible to wireshark
Well, the VMWare people said that those interfaces are invisible to wireshark and a special tool, VMWare-sniffer, can be used.

And btw, 172.xxx.xxx.xxx are non-routable addresses so clearly I had a buffer overflow in my brain.

As for the .2, that's just the way VMWare set it up.