I have read this: Can I detect a MITM attack? My question is very simple, since a MITM attacker consumes double number of packets, is possible to identify him, isn't it?
Technically, if the attacker is sitting between point (A: Your Device) and point (B: Server/ Another User/ ..etc). The attacker will be trying to sniff all the traffic between A and B in order to get access to sensitive information.
Now theoretically speaking, the attacker will be generating a larger amount of traffic since he is sniffing the traffic, maybe modifying it before relaying it to (B), on top of the network traffic it generates.
Now, just because of a attacker generates a large amount of traffic on your network, is not necessarily a correct indication that an MITM attack is taking place. However, the device in question may be a likely candidate. Even then, it is not a valid indication. Also, it is import to note that the attacker not necessarily needs to sniff of the traffic originating from (A), it is possible to regulate it, in this case, your hypothesis of double the traffic generating will fail.
I am not sure if you are understanding a MITM attack properly. Here is an Okayish guide that might be useful: https://www.wandera.com/mobile-security/man-in-the-middle/man-in-the-middle-attack/