People just run the sniffer software.
Again, sniffer programs on unix don't modify system software, they just run. I think you're confused here. It can be, but not the way you're talking about. And the original poster of the thread asked how you can tell if a sniffer is running on your network, not how to tell if your system software has been modified. This is quite out there for one of your posts, you usually have better knowledge of the field.