I tried to explain in which cases WPA networks are subject to "spyability" by other users in this answer. Short: If the attacker isn't on the same WPA2 network, you're safe. If the attacker is on the same network, you're only safe if the network uses WPA2-Enterprise, and not WPA2-PSK.
For unencrypted networks, you can obviously simply sniff off the unencrypted packets from the air – no need to ARP-spoof anything. It's simply like sitting in the middle of a conversation.
For WEP, it's the same when the attacker is in the same network. If the attacker's not in the same network, he'd have to crack the WEP encryption – but that's sadly pretty realistic, given that you can derive the key by triggern known plaintext in relatively short time. As soon as you have the key, sniffing is as easy as on an unencrypted network (or an Ethernet hub, if you remember these).
ARP spoofing is a technique to make other computers send data to you instead of their intended target – but that probably won't work in a simple Wifi – all the station will probably want to send packets to the access point, which doubles as router, and you'd have to convince that router that you are the legitimate holder of its IP address the moment you try to send forged ARP replies.
That'll simply fail, usually. In more complex networks, the access point might not be the router, but still, you'd very likely have to poison the ARP cache on the "backbone" side of the Access Point – a non-trivial problem.