In my opinion, if you are concerned about Wireshark use on you network, then you probably need to look at the broader issues of appropriate network security policy (such as encryption, network access control, separation of duties, and so on).

To be honest if you want to try and manage the impact of packet sniffing on your network you are best off a) having a clear policy for your staff or those authorised to use network - and enforce it as a people management problem and b) lock down your network with appropriate configuration and have appropriate authentication/authorisation/auditing for system administration of your network.

In either case this isn't proof of wireshark use, and can probably be countered by appropriate configuration by the wireshark user. So if you inject a packet into the network with an IP address that other boxes are unlikely to be using, you might see Wireshark trying to do this reverse lookup. Packet capture will now begin - all packets being sent/. If Wireshark has NR turned on, it will try and do a reverse lookup on IP addresses it sees. After selecting the network interface (or using the default interface chosen by Wireshark), click Start. Another thing is to look for the name resolution queries that a Wireshark client might be using.

Machine in promiscous mode (which Wireshark will normally have turned on, respond slightly different to non-promiscuous boxes. As Hansang said one way is to detect how the network responds to certain ARP packets. While packet sniffing is generally quite passive, in that you are meant to be listening to just copies of packets there are techniques.

Wireshark usage network