There is a simple way to detect most sniffers. Put two boxes on the network which are not in DNS and are not used for anything else. Have them periodically ping or otherwise communicate with one another.
Now, monitor your network for any DNS lookups and/or ARP requests for their IPs. Many sniffers will by default look up any addresses they find, and thus any lookup on these devices would be a solid warning.
A clever hacker could turn off these lookups, but many wouldn't think to, and it would definitely slow him down.
Now, if he's smart enough to not enable DNS lookups, and prevents any ARPs for these devices, your task is much more difficult. At this point, you should work under the philosophy that the network is always being sniffed, and enact proactive procedures to prevent any vulnerabilities that would arise under this assumption. Several include:
- Use a fully switched network
- Bind switch ports to MAC addresses
- Disallow promiscuous mode enabling on NICs (if possible in your environment)
- Use secure protocols