The arp poison is actually surprisingly easy to catch, just look at the arp table on your device. If all the mac's are the same, chances are good, you've been poisoned. It's incredibly easy with a couple of different tools, and surprisingly a lot of fun once you figure it out.
I was first shown how to do it at a Wildpackets class by one of the instructors. He was using Cain to do the hack, and making changes to my dns stuff. Looking back I probably should have been ticked off that the instructor was picking on me, but he wasn't the lead instructor, and we were in the back of the room.
Now you want really scary...I used Wildpackets software or Wireshark in my studies for the CCNP. Things made a lot more sense once I started to see the OSPF messages going around and what was included with each packet.
Sadly, I've found (and several others I've met) all say that packet analysis tends to be more art then science. It's easy to teach how to run the tool, but not so easy to teach what to look for within the traces. Best way I learned was to just let traces run at my desk, and see what I could see. Drove everyone nuts around here when the Blaster and Slammer worms were going crazy. I was pin-pointing devices like it was nothing and making folks run around to fix them or I was disconnecting the switch ports.