Hi there, it was indeed permissions case - or capabilities as its called. I had to issue this command to get libpcap working on normal user:
sudo setcap cap_net_raw=eip /usr/bin/node
Then I could start seeing arps being captured by nodered and amazon dash button presses are now fully functional.
Thank you for point this to me.