Many frequency components are transmitted on an Ethernet wire, including the basic clock rate and many subharmonics and the harmonics thereof. These arise from the basic repetitive "framing" of data into blocks or groups of bits. In addition, there is broad spectrum noise arising from the data itself. This normally is more or less random.
I have measured the spectrum of the signal passing over an active 100baseT cable using my IC-R8500 communications receiver. This is sensitive to the narrow-band "carrier" tones that are present at many discrete frequencies. See my data table.
Fraser, G4BJM, contributes a couple of results from his spectrum analyzer. He notes that the biggest peak occurs in the "top band" (160 meters), and the second biggest in the 80 meter band. (Click on graphs for larger versions.)
The measurement was made in my office, 3m from the lan cable tray which runs along the corridor outside, using a 0.9m active loop. This has a near flat response (+/-1dB) from 9kHz to 30MHz. The antenna factor curve was loaded into the measurement receiver. The field strength is represented as the equivalent E field, using 51.5dB as the conversion factor from H field. The discrete peaks are not the lan, they are intentional broadcast carriers.
The lan uses Hewlett Packard type Procure switch 2626 hardware, although I think older hardware is also used in the network. As you say, it's not possible to switch the system off for a background noise check, but I have determined that the local 160 and 80m interference at least is definitely generated by the lan system. The level stays pretty constant, i.e. the cumulative level does not vary day/night or weekday/weekend, so seems independent of data throughput.
This is another plot I did with the loop antenna attached to the
cable tray, i.e. zero measurement distance, so it shows the lan radiated spectrum more clearly. The noise floor of the measurement system is limited by the loop/preamp and is equivalent to 30dBuV/m,