There are lots of articles on the internet about detecting Amazon Dash button presses by looking for ARP Packets. There are also some Python code examples kicking around that claim to do this for you, but it didn't seem to work for me.

Undeterred, I fired up tcpdump.

tcpdump -n "icmp or arp or broadcast"

Eventually I found something that looked like it would work:

root@desktop:~# tcpdump -n "icmp or arp or broadcast"
22:01:03.354682 IP > BOOTP/DHCP, Request from 00:11:22:33:44:55, length 297

A BOOTP packet. That'll do!

Some simple Python:

import fileinput
import logging
import re

import requests

MAC_FILTER = '[0-9a-f:]{17}'
LOGGER = logging.getLogger()

if __name__ == '__main__':

    for line in fileinput.input():
        if 'BOOTP/DHCP' in line:
            macs = re.findall(MAC_FILTER, line)

            for mac in macs:
                if mac == '00:11:22:33:44:55':
          'Toggling for %s', mac)
          'http://localhost/api/something/awesome', data='thunderbirds are go')

Just run it like this

~# tcpdump -l -n "broadcast" 2> /dev/null | python3 -u -m monitor

The -l is important to stop tcpdump from buffering it's output.