They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain.
When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the server's ISP's local router, through the data center's network infrastructure, and eventually to the actual server. In total there may be as many as 40+ routers involved, if you're routing across the globe. If any single one of these is compromised, an attacker could sniff traffic.
However, your primary risk scenarios are:
- User's computer is compromised.
- User's network is compromised.
- Server's network is compromised.
- Server is compromised.
In scenario #1, you can't do anything to prevent the issue. Their system is compromised and their credentials can be stolen. You can help mitigate the issue by asking for 3 characters of a secret word each time they log in, but decent malware would just steal the session ID or something similar.
In scenario #2, an attacker can put their network adapter in promiscuous mode, which allows them to sniff the traffic on the network. If you don't use SSL, this traffic can be read, tampered with, etc. Protecting users from this scenario is the primary reason for using SSL.
In scenario #3, a similar issue occurs, but it's on the server network. The requirements for a successful attack here are largely based on network layout and configuration, since the position of the compromised system on the network is critical in terms of whether the attack will be successful. A switch between their system and yours could prevent promiscuous sniffing. It's pretty hard to know whether or not this kind of attack is happening (it's not your network, it's the hosting company's) so SSL is a good protection here.
In scenario #4, you're screwed again. Your server is compromised and no amount of transport security will save you.
There's a 5th scenario, whereby an ISP or backbone provider (e.g. Level3) are actively logging and sniffing traffic on their network. If you care about this, SSL can help. If you're worried about state actors (e.g. the NSA, with PRISM), then SSL isn't really going to help you, as they can use warrants to get hold of the server's private key and decrypt all of the traffic.