That only works if you use a hub instead of a switch, or if the traffic is broadcast, or if you somehow convince the switch to give your port all traffic. It's easiest to just use two NICs bridged in one PC as a MITM.
There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.