Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to disable either the tx or the rx in a NIC? I am setting up a network monitoring machine and I would like to be sure that no packet will be introduced by this machine at the network.

One approach would be use some sort of netfilter feature to block all out coming packet from that interface. But this add extra work to the server since it will need to filter all packets that may leave the interface.

share|improve this question
add comment

4 Answers

up vote 5 down vote accepted

The easiest way to do this is to use a custom-built cable with doesn't have the TX pin connected. Cables are trivial to make, you just have to follow the correct color pattern. You'll also have to make sure you put the TX-disabled connector in the computer and not the switch, but that's easy to fix if you get it wrong. :)

share|improve this answer
add comment

I am setting up a network monitoring machine and I would like to be sure that no packet will be introduced by this machine at the network.

That part doesn't make much sense.

And then how do you plan on using the system itself? Even a network monitoring system would need access to send traffic. Email Notifications, SMS notifications, ping tests outbound, etc. It can't operate effectively if all it does is receive.

share|improve this answer
show 2 more comments

If running Linux you can use iptable to block all traffic:

iptable -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP

share|improve this answer
add comment

[The question is a bit old but I think none of the responses captured the full answer.]

Assumptions

  1. The scenario is as John described: a network sniffing system with:

    • one NIC for remote management (which therefore must receive and transmit)
    • a second NIC which will receive mirrored packets from the network switch (but which must not transmit)
  2. The management interface is eth0 and the sniffing interface is eth1.

Approach

  1. I agree that the best solution includes a modified cable, if your switch supports it. In addition to ACLs on the network switch (see below), this cable is a line of defense against configuration errors which inadvertently leak information via the sniffing interface.
  2. The iptables commands below don't protect you against attacks via the monitored interface, even with a modified cable. Be certain that your sniffing system:
    • doesn't have any services (like ssh) listening on the sniffing interface
    • has IP forwarding disabled in the kernel (via /proc/sys/net/ipv4/ip_forward or /etc/sysctl.conf for preference)
    • uses unique passwords
    • isn't trusted by any other system
    • is kept up to date with security patches
    • has inbound (i.e. from the sniffing system to the switch) ACLs on the network switch port for the management interface, to control what the sniffing system can emit
    • has inbound ACLs on the network switch port for the sniffing interface, to drop all packets.

Commands

For iptables under Linux:

iptables --insert OUTPUT 1 --out-interface eth1 --jump DROP
iptables --flush FORWARD
iptables --append FORWARD --jump DROP
iptables --policy FORWARD DROP

This first line inserts a rule at the start of the output rules table, and shouldn't affect other traffic.

YMMV because I haven't tested ;-).

--klodefactor

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["        <li><a href=\"http://area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"http://careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.7.11.1700\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscr"], "copyright__copyright__copyright": ["1 --jump DROP\niptables --flush FORWARD\niptables --append FORWARD --jump DROP\niptables --policy FORWARD DROP\n\nThis first line inserts a rule at the start of the output rules table, and shouldn't affect other traffic.\n\nYMMV because I haven't tested ;-).\n\n--klodefactor\n\nshare|improve this answer\nadd comment\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}