Here are some ways to modify traffic on typical networks, most have command-line or GUI point-and-click attack tools available. Some of these are documented to have been conducted on wide blocks of internet traffic.
The attacker broadcasts a SSID of 'Free Public Wifi', or one similar to what you normally use, then DoSes all other access points when you try to use them.
The attacker is on the same ethernet broadcast domain and replies to your DHCP query quicker than the legitimate DHCP server does.
The attacker poisons the router's ARP cache and impersonates your MAC.
The attacker leverages the unauthenticated nature of Spanning Tree Protocol STP.
The attacker pwns your home wifi router through a default password on its admin page or any number of other bugs.
The attacker messes with your DNS name resolution for sites of interest. Remember that time DNS resolution for some S. American (and a few US) ISPs got routed through the great firewall of China?
The attacker advertises a more-specific route for your IP address or that of a target site. Remember when that little ISP in Pakistan took YouTube offline?
The attacker could be your ISP working under order of some government. Yours, that of a country you're visiting, or of some territory the packets pass through along the way.
Or you could be using a hotel, airplane, library, mobile, etc. internet connection where transparent intercepting MitM proxies are standard fare. How good do you think the hotel staff are at securing that internet billing appliance they bought?
And of course, the attacker could always cut a cable somewhere and install a tap.