HA!  OK, this is funny :).

I got Wireshark working.  Cool.  I start looking at traffic going by.  I see various IP addresses being talked to.  OK...cool...go find out what the IP addresses lead to.  One of 'em leads to...FACEBOOK?  WTF?  I don't use it, I don't *think* anything in my VM uses it...and then I realize what's going on!  Heh.  Call my landlady.  "Hey, were you just using Facebook?"  "YES, HOW DID YOU KNOW THAT!?"

:)

So that's where the "extra" traffic is coming from all this time.  My friggin' landlady :).

That's OK.  I'll just do my malware testing late at night when she's asleep :).

Jim