VM triggered by passing traffic