It could detect an open microphone, which is the topic.

The microphone's input would either need to be transmitted continuously (which is detectable with Wiresharp or other traffic monitoring tools), or stored which neither the Echo or Echo Dot have large enough capacity to do for any significant length of time.

You can get really great quality voice audio taking as little as 2KB/s(I work with VOIP solutions so I have some idea). At that rate, that's 168MB/24 hours. But then if you consider that you only need to record when someone is actually talking(don't record below certain threshold) you probably only need to store 5-10MB of data a day. You can just write that much to ram, I'm sure Echo has enough to do that. Then upload data periodically when someone sends an actual command to the server.

Presumably there is enough silicon onboard to keep a tally of interesting keywords, compute a very rough terrorism score and upload that once a month. Three letter agencies could follow-up with additional measures for those that pass a threshold.

Wireshark could see the packets moving across the network, but you might have issues seeing the payload. More so if the echo does certificate pinning.

Also, there's no reason that such packets would have to be sent immediately. It's totally possible that, during times when a wake-word is not utilized, they could still record, compress, and delay transmission of recordings until a less conspicuous time (middle of the night, weekend, following a reboot, or in tandem with the next 'expected' transmission).