Hi lyonsd,
ethereal should be in RH9, it does the trick. If you merely want to monitor where your darlings are surfing the net, etherape gives a good overview.
Keep in mind that your NIC must support "promiscuous mode", means, forward packages to the OS that are not meant to be for its MAC address - most cards do so on Linux, but don't tell me I have not told you
Keep in mind, monitoring a Person's network usage breaks their privacy, so be sure to announce to your users that you are monitoring and check if your local laws allow you to.
HTH, Peter
P.S.: Of course, you cannot monitor traffic that is kept away from you by a switch - for true monitoring, use a hub instead, because switches redirect the traffic to a specific NIC's MAC only to the switch port the NIC is connected to, and not to the other Switch ports!
P.P.S: Glossary: NIC = Network Interface Connector, the Ethernet card; MAC = Media Access Code, the hardware-given Ethernet Address identifying the NIC.