Any decent VPN will ensure encryption, but of course it would have to be configured on each and every machine. IPsec is a VPN technology which has the advantage of being built-in at the IP level and already implemented in your operating system (if it is not, then learn that it is high time that you upgrade these Windows 98 machines).
Note, though, the following important points:
- Any attacker would can subvert one of the machines will be able to snoop on every packet that the machine receives and is able to decrypt.
- Even if you configure IPsec so that every two machines negotiate an encryption key which is shared between exactly these two machines (and none other), so that a subverted machine may see only these packets which are destined to it, it may happen that this subverted machine, by sending maliciously crafted packets, could redirect traffic to it (e.g. by poisoning the DNS).
That's a limitation of all these encryption setups: they are great at establishing a strong isolation between the local network machines, and the outside world. However, they usually do nothing against local attackers, i.e. attackers who could gain control of one "allowed" machine (as opposed to attackers who just plug into a free switch port or join a WiFi router).
Machine subversion is, unfortunately, a rather common occurrence. It usually goes through email viruses, malware from the Web, even malicious USB keys... (if a user finds a USB key in his mailbox, what will he do ? Well, 95% of the users will plug it in their machine, to see what is on it).
Another important point is that if you succeed at preventing packet sniffing, then, well, packet sniffing is no longer possible. In particular packet sniffing by sysadmin tools that look for malware and virus. Encryption is a multi-bladed weapon.