Systems and methods are disclosed that provide direct network traffic monitoring within virtual machine (VM) platforms operating in virtual processing environments. The disclosed embodiments in part provide direct network packet monitoring through client packet monitor applications that run within client VM platforms to obtain packet traffic and to forward this traffic directly to tool packet monitor applications operating within tool VM platforms. Further, the tool VM platforms can receive multiple incoming streams of network packets from various client VM platforms, and these incoming streams can change over time due to changes in the number of client VM platforms running within the virtual processing environment. Preferably, the network packet streams are communicated using encapsulation tunnels and related encapsulation headers, such as GRE tunnels using GRE identifiers in related encapsulation headers. These tunnels can be used to selectively forward particular packet streams to particular destination tool VM platforms.