Consider this type of non-standard man-in-the-middle attack, which is fundamentally the same nature of attack without the poisoning phase being required:
Someone cuts the internet line at your house, or anywhere between you and your ISP, and re-joins it with a piece of hardware designed to let the data pass through as usual but also record it.
How could you detect and defend against this type of attack?
The result of this attack is not really different from someone compromising your router, your ISP, your VPN endpoint or similar: the attacker will be able to intercept and modify the traffic.
Depending on the way the attack is done and depending on the characteristics of the line (i.e. FTTH vs. xDSL vs. cable...) one might detect changes to the line behavior like increased error rate, lower bandwidth or larger latency but if the attacker has done a proper job everything will look fine and nobody will notice.
Apart from the described problems with unprofessional hacks (bandwidth, latency) there will be no visible difference on the network layer if only passive sniffing is used. But if traffic modification is done you will notice it with protocols which have a built-in integrity check, like in case of HTTPS or VPN.
One defense against the attack would of course by to physically secure the line against the attack. But usually the line is not in your full control. The other way is not to defend against the hack itself but against its results: since the attacker wants to sniff and/or modify the traffic you should only use protocols with built-in encryption and integrity, i.e. send all your traffic through a VPN.
