VMWare emulates the NIC that the guest operating system sees, and in so doing, it uses a MAC address prefix registered to VMWare by the IEEE. The MAC prefix is the first three octets of the six octet MAC address. I don't remember what they are offhand, but VMWare's MAC prefixes are well-known. If you compare the guest-OS-reported MAC addresses of your virtual machines versus your physical machines, you'll see a pattern. If you can then figure out a way to get RMS to filter on that, you'll be golden.
KDH