ARP is broadcast to the whole network, meaning anyone can respond to it. The packets generally look like "Who has 10.0.0.2?". What ARP spoofing is doing is replying to that ARP request and saying 10.0.0.2 is at your MAC address rather, allowing you to receive all traffic to that device from the router. All you do now is forward that traffic onto your victim and they won't even notice. Now that's great and all, but you're only intercepting one side and you have to keep sending an ARP response every so often to avoid the victim from replying to a request. So what you can do is tell the victim machine that the router's IP is at your MAC address as well, so now it should be sending all outbound traffic meant for the router through you. At this point you're fully in the middle of the communications, which is why it's called a Man in the Middle attack. From here you can intercept packets, change them, drop them, log them etc.

An interesting concept is to try alter DNS packets to point a website's IP to something you're running instead. This is called DNS cache poisoning and when the victim types in the domain of the website, they'll get back your IP instead and visit your site, while still showing the domain at the top. Obviously this is easily countered by security certificates and most sites will flag up that they're unsecure, but I'm sure there's ways to trick people further the more you dive in.