I can't speak for Parallels, but for VMware Fusion in NAT mode all connections are made via the vmware-natd process which can be filtered by tools such as Littl

I can't speak for Parallels, but for VMware Fusion in NAT mode all connections are made via the vmware-natd process which can be filtered by tools such as Little Snitch.