I would recommend running ntop on the Linux box. I don't have Ethereal installed on this machine so I can't look at the options, but I remember the windows version having an option to log only some ports or packet types. Now when I did this we had to configure the switch to repeat every packet to my port on the switch or it wouldn't work.