If all relevant traffic runs across the core switch and there's enough link headroom you could set up port mirroring to a monitor port on the core switch, capture and analyze the traffic. Provided a single port isn't overwhelmed by the amount of traffic, you'd catch every single frame running across the core switch.
Alternatively, you can tap each core switch port separately to see what kind of traffic it carries.
If there's relevant traffic inside the access switches you'd need to tap them as well. However, mirroring that traffic through the core uplink isn't advisable unless there's plenty of headroom on the link. I'd use a separate, dedicated monitoring link to the monitoring system.
Alternatively, you could use sFlow or Netflow to monitor larger flows. The downside is that these don't capture every single frame but use a statistical subset. Depending on what you're looking for, that flow may or may not be represented. The upside is that you can run sFlow/Netflow continuously without any dedicated cabling.