[The question is a bit old but I think none of the responses captured the full answer.]
The scenario is as John described: a network sniffing system with:
- one NIC for remote management (which therefore must receive and transmit)
- a second NIC which will receive mirrored packets from the network switch (but which must not transmit)
The management interface is eth0 and the sniffing interface is eth1.
- I agree that the best solution includes a modified cable, if your switch supports it. In addition to ACLs on the network switch (see below), this cable is a line of defense against configuration errors which inadvertently leak information via the sniffing interface.
- The iptables commands below don't protect you against attacks via the monitored interface, even with a modified cable. Be certain that your sniffing system:
- doesn't have any services (like ssh) listening on the sniffing interface
- has IP forwarding disabled in the kernel (via /proc/sys/net/ipv4/ip_forward or /etc/sysctl.conf for preference)
- uses unique passwords
- isn't trusted by any other system
- is kept up to date with security patches
- has inbound (i.e. from the sniffing system to the switch) ACLs on the network switch port for the management interface, to control what the sniffing system can emit
- has inbound ACLs on the network switch port for the sniffing interface, to drop all packets.
For iptables under Linux:
iptables --insert OUTPUT 1 --out-interface eth1 --jump DROP
iptables --flush FORWARD
iptables --append FORWARD --jump DROP
iptables --policy FORWARD DROP
This first line inserts a rule at the start of the output rules table, and shouldn't affect other traffic.
YMMV because I haven't tested ;-).