I think there are a few things to deal with here, so lets try:
"My problem is I can't seem to figure out/understand how one can detect a packet sniffer by pinging the ip address and a slight change of the suspected MAC address"
Unless you happen to have a complete list of every device on your network (including IP address and Mac address), you won't easily be able to tell if this device should or should not be on the network. Sniffer programs can sit on any type of computer device (Laptop/Desktop) and must have a valid IP address and Subnet etc. So like I said above, unless you know every device on your network, finding a sniffer is difficult. The other thing to consider is a sniffer is just that, a sniffer. It sits on the network and just watches what goes past, and takes a copy. It doesn't interact with the network.
"neither do I know/understand how to send arp requests to the suspected sniffer."
Again, see above. In addition, arp requests are usually sent by devices to find out how to get to/from a specific device. The arp cache is normally a dynamic list of addresses. If you want to see what one looks like, then try the following: One of your PCs, ping a know device. Once you have had a response, type the following command: arp -a. This will show you all the devices your PC is aware of.
Finally, MAC addresses are hardcoded onto every device. So, although an IP address can be changed (by administrators etc), the mac address is constant. So, pinging an IP address and different MAC address doesn't seem like a good idea.
I hope that made some kind of sense, but it is still early(ish) in the morning, and my brain isn't fully awake yet!!!
