MAC address of the gateway is different from the MAC address of VM1 (attacker) before the attack.