Using a router to intercept HTTP data. Sniffing

More expensive switches will offer port mirroring, where they will mirror the traffic of one or more ports to a dedicated monitor port for (among others) problems like yours.

But I am not sure at what price class features like that are offered.

Sniffing a remote server is possible, though not easy. The most effective (though not reliable) is to compromise another device on the same subnet as the web server to the level that you can execute a sniffer. At that point you deploy ARP Poisoning to convince the switch that you need to see that server's traffic. If the switch isn't set up to defend against that kind of attack, this should give you the full network stream to the target web-server. However, it does require you to compromise a host to get access to another host, so the bootstrap chain to get to this capability is pretty long and complicated as it is.

The next most effective method is to compromise the router attached to that network. At that point you can do a lot of interesting things including (depending on the router) forwarding traffic destined to that target web server to another network location you control. This method, however, is generally a lot harder than the first one. Network admins tend to lock this kind of thing down a LOT harder than server admins, in large part because the attack surface is a lot smaller. Also, rare is the router administrative address accessible to a public network in any way.

As a recon method, sniffing is more useful when breaking into an application once the web server has already been cracked. Perhaps they're looking to sniff a back-end network for credentials passed in the clear to a database over an assumedly secure channel. This method is one used by sophisticated attackers, and generally isn't in the 'sploit toolkit repertoire.