I am going to be demoting some DC's and want to see if there is a way via wireshark or netstat or something to see if a server might be out there that has statically mapped to them for LDAP queries.
Unfortunately no - from that DC, you cannot tell which machines are hitting it via LDAP because they queried DNS to get any LDAP server, or which machines are hitting it because they are configured to hit only it.
Using one of those tools, you could determine which machines are using it for LDAP in the first place, but that won't tell you why they are querying it, or which applications are doing so.
In the future, if you maintain this environment long term, it's best to use documentation and standards so that you will know for sure which DCs are being used for LDAP queries by applications that can't simply query DNS or AD for a list of them.
For DNS, you can turn on logging and you'll know that any clients in the logs need to be reconfigured.
Here's a more general approach to the overall topic of "How do I decommission a server that might still be in use?" : How to identify who/what uses a Windows 2003 server?