There is a very good article on "sniffing switches" at http://www.linuxjournal.com/article.php?sid=5869&mode=thread&order=0
which uses ARP hacking.