You could set a port in monitor mode (I.E. set it as a span port) then use an external device to capture and analyse traffic.
extract from Cisco Security Appliance Command Reference, Version 8.0
switchport monitor
For models with a built-in switch, such as the ASA 5505 adaptive
security appliance, use the switchport monitor command in interface
configuration mode to enable SPAN, also known as switch port
monitoring. The port for which you enter this command (called the
destination port) receives a copy of every packet transmitted or
received on the specified source port. The SPAN feature lets you
attach a sniffer to the destination port so you can monitor traffic.
You can specify multiple source ports by entering this command
multiple times. You can only enable SPAN for one destination port. To
disable monitoring of a source port, use the no form of this command.
switchport monitor source_port [tx | rx | both]
no switchport monitor source_port [tx | rx | both] Syntax Description
source_port
Specifies the port you want to monitor. You can specify any Ethernet
port as well as the Internal-Data0/1 backplane port that passes
traffic between VLAN interfaces. Because the Internal-Data0/1 port is
a Gigabit Ethernet port, you might overload the Fast Ethernet
destination port with traffic. Monitor the port Internal-Data0/1 with
caution.
tx
(Optional) Specifies that only transmitted traffic is monitored.
rx
(Optional) Specifies that only received traffic is monitored.
both
(Optional) Specifies that both transmitted and received traffic is
monitored. both is the default. Defaults
The default type of traffic to monitor is both.