Is there a way to determine which virtual interface belongs to a virtual machine in a kvm host?

How about this (example for vnet13):

$ VNET=vnet13; for vm in $(virsh list | grep running | awk '{print $2}'); do virsh dumpxml $vm|grep -q "$VNET" && echo $vm; done

Here we use virsh dumpxml to show dynamic properties about the VM, which are not available in the static XML definition of the VM in /etc/libvirt/qemu/foo.xml. Which vnetX interface is attached to which VM is such a dynamic property. Same goes for the VM's MAC addresses.

Try virsh dumpxml $domain, you'll see something like:

  <interface type='network'>
  <mac address='52:54:00:9d:9d:10'/>
  <source network='default'/>
  <target dev='vnet1'/>
  <model type='e1000'/>
  <alias name='net1'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x0c' function='0x0'/>

the alias name is what is used in the qemu-kvm command line, so if you run ps -ef |grep qemu|grep net1 from my example, you will see the actual command syntax used for this interface.

Run virsh domiflist myVM. This command will list all the interfaces related to VM myVM.

 Interface   Type      Source      Model    MAC
---------------------------------------------------------------
 vnet0       bridge    mgtbridge   virtio   52:54:00:3c:f3:df
 vnet1       bridge    habridge    virtio   52:54:00:8a:b3:b6
 -           hostdev   -           -        52:54:00:b0:eb:b7
 -           hostdev   -           -        52:54:00:44:26:94

Every one of the solutions given above assumes that the VMs are being managed by libvirt. It is quite possible to run QEMU VMs without that, in which case you cannot use virsh or look at XML to find the answer.

In the case of running QEMU VMs from a "raw" command line:

1. tcpdump -i tap0 -f 'icmp' (substitute whichever tap interface you're interested in)

2. Ping each candidate VM until you see packets in the trace. The interface you are tracing when ICMP packets appear is the one you're looking for!

Conversely you can start a ping to a particular VM and then tcpdump each tap interface in turn until one "lights up". Depends whether you're interested in finding the VM that matches the tap interface, or the tap interface that matches the VM.

Match IP Addresses from Arp cache to VM

# vm mac address list
for vm in $(virsh list | grep running | awk '{print $2}'); do \
  echo -n "$vm "; \
  virsh dumpxml $vm| grep -oP "52:54:[\da-f:]+" ; 
done > vm_mac.list

# vm ip list
arp -i virbr0 | grep '52:' | while read addr ; do \
  ip=$(echo $addr | awk '{print $1}'); \
  mac=$(echo $addr | awk '{print $3}'); \
  vm=$(grep "$mac" vm_mac.list | awk '{print $1}'); \
  echo "$vm $ip $mac"; \
done | sort

Sample output:

vm66 192.168.191.112 52:54:00:ab:e8:cb
vm67 192.168.191.207 52:54:00:88:66:e7
vm67 192.168.191.241 52:54:00:88:66:e7
vm68 192.168.191.197 52:54:00:c5:e1:30
vm69 192.168.191.254 52:54:00:b6:f6:0f
vm70 192.168.191.232 52:54:00:08:7f:49
vm71 192.168.191.113 52:54:00:e7:6f:2b

Based on @daff response:

for vm in $(virsh list | grep running | awk '{print $2}'); do echo "$vm: " && virsh dumpxml $vm | grep  "vnet" | sed 's/[^'']*''\([^'']*\)''[^'']*/\t\1/g'; done

Output Example:

vm1:
    vnet0
vm2:
    vnet1
vm3:
    vnet2
vm4:
    vnet3
    vnet4
vm5:
    vnet5

The MAC address of the vnetX interfaces belongs to the host, not the guest. brctl showmacs br0 will show the MACs detected by the bridge, but you'd then need to cross reference the port number with the list of interfaces from brctl show.

for vm in $(virsh list  --state-running --name); do \
echo $vm; \
virsh domifaddr $vm; \
done

Example output:

client1

Nombre     dirección MAC       Protocol     Address
------------------------------------------------------------------------------

vnet2      52:54:00:2c:7a:f0    ipv4         192.168.122.63/24

This will list all running VMs along with their interfaces:

for vm in $(virsh list --state-running --name); do echo "$vm: " && virsh domiflist $vm | sed -n "3,$ { s,^,\t,; p }"; done