1. Ping Method - ping suspect machine with its ip address and incorrect MAC address. If machine accepts it, it is in promiscuous mode.
2. ARP Method - send non-broadcast ARP, the only one that will reply is the machine in promiscuous mode. Other machines will send ARP probe.
3. DNS Method - Machines doing a lot of reverse DNS lookups are probably sniffing.