If you watch traffic in real time, you can see that an attacker doing a MiTM attack does ARP spoofing because MAC addresses will be duplicated, etc. And, well, you can see all MAC addresses and see who is a router and check if MAC addresses of the router match.
But what if we know that an attack was done yesterday, for example? How can we find out which MAC address was ARP spoofing and sending fake certificates (let's assume user accepted that)? Let's say an attacker stole some bank account credentials on a site that uses HTTPS. Is it even possible?