You can connect to a guest console over a network if the listen_addr property is set to the IP address of the control domain in the vntsd(1M) SMF manifest. For example:
$ telnet hostname 5001
A Service Management Facility manifest is an XML file that describes a service. For more information about creating an SMF manifest, refer to the Oracle Solaris 10 System Administrator Documentation (https://docs.oracle.com/cd/E18752_01/index.html).