Wireshark may or may not help you here. The proposed mechanism is abusing the wake words, which are processed locally on the device. Each marketing wake word could be processed, set a flag and go back to sleep with no network activity. Periodically a bit array of flags would be sent to the server with any other regular traffic (checking for notifications, perhaps). The actual audio never gets sent. I'm not saying that Facebook actually does this, but it's a reasonable explanation for the behaviour seen in the Vice article.