You shouldn't need to actually view the data. Just check the payload size. Compare the traffic at idle to the traffic that's sent when you speak to it. If it's

You shouldn't need to actually view the data. Just check the payload size. Compare the traffic at idle to the traffic that's sent when you speak to it. If it's comparable, now it's time to be suspicious. If there is a noticeable spike after saying the wake word, then you can be fairly certain it's actually waiting for the wake word.