The network had been rebuilt four times by three different people, and only half documented each time.
One time, each VM had been named after planetary bodies. Sol was the AD, Jupiter the print server, etc.
We found one called Mars. Completely undocumented. Doesn't exist so far as the docs knew. The previous admin didn't remember it.
I ran Wireshark, and got nothing.
So... I didn't just shut it down, but I deleted it.
Took 10 minutes for mass panic to hit the office.
Mars was the gateway for our publicly exposed servers. No website, no email, no VPN.
Our daily backup only copied data, not actual images.
So, just hoping, I threw a reverse pass through proxy up on the same IP, with routes for our servers.
Quiet returned, as I went about recovering the Mars image I had deleted.
Lesson learned: if you are working in unknown territory, let it break before deleting. Also, add VM images to the backup routine.