Detection Every ethernet card has a MAC address with it. The job of the local routing package is to translate IP addresses into these MAC addresses. The routing package on your network knows the MAC address of every ethernet card attached to its segment. When a router gets a new datagram it decides that it is local by matching the IP address to a MAC address on some machine.
Every machine then takes a look at the datagram as it passes by.
However most machines shouldn't be doing this. Since passwords fly across the network quite often, it is easy for a Bad Guy to get hundreds of passwords in only a few days. For this reason it is important to check your ethernet card regularly to make sure it is not in promiscuous mode. Incidentally, if someone has put your card in promiscuous mode, your machine has had a root compromise. Hence, a simple cron job can give you early warning of any problems.