diff --git a/conf.c b/conf.c
index bc8851f..f5b761f 100644
--- a/conf.c
+++ b/conf.c
@@ -676,9 +676,6 @@ static void conf_ip(struct ctx *c)
 			nl_link(0, c->ifi4, c->mac, 0, 0);
 	}
 
-	if (c->mode == MODE_PASST)
-		memset(&c->mac_guest, 0xff, sizeof(c->mac_guest));
-
 	if (v6 != IP_VERSION_DISABLED) {
 		int prefix_len = 0;
 
diff --git a/tap.c b/tap.c
index a3c711c..43a7372 100644
--- a/tap.c
+++ b/tap.c
@@ -794,6 +794,12 @@ static void tap_sock_unix_init(struct ctx *c)
 		exit(EXIT_FAILURE);
 	}
 
+	/* In passt mode, we don't know the guest's MAC until it sends
+	 * us packets.  Use the broadcast address so our first packets
+	 * will reach it.
+	 */
+	memset(&c->mac_guest, 0xff, sizeof(c->mac_guest));
+
 	for (i = 1; i < UNIX_SOCK_MAX; i++) {
 		char *path = addr.sun_path;