Intruders are often quick to backdoor systems so that normal utilities like ps and ifconfig will not provide reliable output. If you notice your CPU load is higher than normal, or that every day you lose one more meg of disk space that can't be explained, it may point to the presence of a sniffer. This type is easier to spot because their logs will be much larger, they will eat up much more CPU, but in return it will log much more. On large networks, these sniffers may generate up to ten megabyte logs a day if set to log all interactive traffic. Sniffers designed to monitor interactive traffic as well as mail may grow even faster.
Sniffers also have different methods of logging.
The other method will capture the entire session, which would make it into a key logger. Some of the more versatile sniffers will support both methods. These will vary depending on the intruder and the desired end result. If you are interested in more details on how a sniffer works, there is an excellent two-part paper by Chad Renfro . He details the basic elements of programming a sniffer which requires a working knowledge of the C programming language.