Higher end NICs, like the i350, support having "virtual hardware" NICs. The i350 supports up to 8 virtual NICs per port, each with their own frame size, VLANS, and interrupts. They work exactly like separate physical NICs and report to the host as desperate NICs.
In this case, you can use the VT-D, or whatever, and pass through the "hardware" virtual NIC directly to the guest and get rid of the overhead of passing it through the host. Because guests are not really aware of each other, the i350 specifically, has an internal switch, and can switch traffic between these virtual NICs without having them go out to the switch and it does this at the full PCIe 2.1x4 speed(2GB/s full-duplex).