If the machine that you are looking for is actually broadcasting, you will see that with Ethereal regardless of where on your subnet you install it. The fact that you didn't see any broadcast traffic with Ethereal indicates that you aren't having a broadcast storm.
In a switched environment (like the one that you are in) you should be able to simply look at the LEDs on the switch and identify a noisy machine, because only it's port, and the port of its destination traffic should be flashing wildly. In a broadcast storm, all LEDs flash, but you will see the traffic on any port with Ethereal.
Ethereal behaves like any protocol analyzer in a switched environment, it can only see the traffic that is destined for the port on which it is installed. That will include all broadcast traffic, and any traffic to a host on that port. If you have a managed switch, you can set a port to "mirror" or "monitor" another port. Then you will see all of the traffic to and from that port instead.
If you don't have a managed switch, you can look for an application that will allow you to do ARP cache poisoning. Poisoning the cache will allow you to see all traffic for all ports for a short period of time while the switch attempts to rebuild its cache. You can continue to poison until you collect enough traffic.
What symptoms are you seeing that make you suspect that the network is being overwhelmed?
By the time you work all of this out, you will probably be better off just disconnecting one machine at a time to see where the problem resolves itself. It sounds as if your network is fairly small.
pansophic
