My two cents:
If ur friend is on a *nix system, he can first note the MAC address of the router from the router web panel, and then run the following command:
He can verfiy the MAC address that the router is at in the ARP table. If the MAC address of the router is different than what it should be, that is one indication.
You can verify the DNS resolutions for say facebook.com by running:
, if the address returned is a local address say, 192.168.0.105 or something, this should indicate that ur DNS resolutions are being hijacked.
Easier yet at the application layer i.e in the browser, whenever ur browsing a website which uses credentials or anything sensitive, check the URL bar to determine if the communication is happening over HTTPS. Even if the traffic is being sniffed say by a LAN connection to a switch, your traffic would be unreadable to the attacker due to HTTPS.