The guide MikeStoica referenced should have all the information you need here, but just wanted to add my 2 cents:
"What is not really clear to me is how to witness detects a site failure."
It is aware of the state of the cluster by the fact that it is in constant communication with the Master and Backup nodes that each reside on one of the data-sites, if both sites are accessible to the Witness but they cannot communicate with each other (e.g. the ISL is down) then it sides with the currently set Preferred Fault Domain to avoid split-brain scenario.
"Is believe there is another method for this using a separate vmkernel adapter for witness traffic but can't really find any
good info on this."
I would always advise using WTS where available as while it may seem more complicated (e.g. additional configuration required) it does simplify things by splitting traffic out (and it is easier to troubleshoot as a result of this).
Tnx i will check this out and get back if I need some more clarification.