The network folks let me install a tap, so we fired up knoppix-std on a laptop with ntop, and have all the data we need. Thanks for all the useful tips though, guys. I learned about some tools I didn't know about before.