"NTop" + "Switch port mirror" should solve your problem. htt...
http://www.net130.com/CMS/Pub/cert1/cert_ccna1/ You will find what you want.