Microsoft Copilot Network Analysis with Wireshark

This article is the second in a series where I explore how AI tools can work hand in hand with Wireshark to help network engineers capture, inspect, and analyse network traffic.

Introduction & Concept

This article is the second in a series where I explore how AI tools can work hand in hand with Wireshark to help network engineers capture, inspect, and analyse network traffic. We engineers all know how time-consuming it can be to manually sift through endless network packets trying to spot anomalies or patterns. With the help of AI, that tedious process can be dramatically simplified, allowing us to parse and interpret network data far faster (and often more accurately) than we could with just our eyes and a mouse cursor.

Understand Wireshark’s native PCAP file is not supported in Co-Pilot so I had to export the file in CSV format, see below link for supported file formats.

Supported file formats

As you can imagine, I’ve kept the traffic capture as minimal as possible to avoid revealing too much about my live network, so focusing only on Google searches and generating Microsoft 365/Azure traffic. Let’s get started!

Part One - ChatGPT Network Analysis with Wireshark
Part Three - Google Gemini Network Analysis with Wireshark

Step One

From the Wireshark Interface, Select the NIC you want to capture traffic from.

Step Two

Start Capturing Traffic, by selecting Capture/Start. Keep the capture file to about 500 packets for best results.  (if traffic populates too quickly, reduce the number of applications in your taskbar)

Step Three

Pause the Traffic Capture by selecting Capture/Stop and File/Export traffic and save PCAP file as .CSV file.

Step Four

Login to Co-pilot and upload the .CSV file or you could simply copy and paste the .CSV contents into the prompt. Note you have to give Co-pilot context of what it’s about to analyse so just enter “Can you analyse my Wireshark Capture?”

Step Five

Now that the .CSV file is uploaded we are going to use the following tried and tested “prompts” to query the Wireshark Capture. Again, be creative and use prompts that are applicable to your network context.

Example Prompts

• 1. Generate a table of all destination IPs by count
• 2. Extract HTTP/HTTPS URLs and hostnames from this capture
• 3. Produce a table mapping each hostname to the IP addresses
• 4. List the Azure services
• 5. Create simplified diagram showing application traffic flows

Each of these prompts can be used individually to generate a range of responses from the AI interface.

1) Generate a table of all destination IPs by count

Copilot Output

Here is a table showing all destination IPs and their respective packet counts from your Wireshark capture:

2) Extract HTTP/HTTPS URLs and hostnames from this capture

Co-Pilot Output

Here are the DNS query domains extracted from your Wireshark capture:

Notes:

These domains suggest activity related to:

• Google services (Android clients, telemetry)
• Microsoft telemetry and event tracking
• Webex conferencing

3) Produce a table, mapping each hostname to the IP addresses

Co-Pilot Output

Notes:

As we can see the timestamps logic is an arbitrary number only Co-pilot can understand, which is clearly no help to us

4) List the Azure services

Co-Pilot Output

The DNS queries in the Wireshark capture include several Azure-related services, identified by domain names containing keywords like azure or microsoft. Here's the list:

☁️ Azure Services Queried

• eu-mobile.events.data.microsoft.com
• browser.events.data.microsoft.com
• mobile.events.data.microsoft.com
• onedscolprdweu04.westeurope.cloudapp.azure.com
• onedscolprdgwc00.germanywestcentral.cloudapp.azure.com
• onedscolprdwus05.westus.cloudapp.azure.com
• onedscolprdcus19.centralus.cloudapp.azure.com
• onedscolprdeus01.eastus.cloudapp.azure.com
• onedscolprdcus21.centralus.cloudapp.azure.com

Notes / Observations:

These domains are typically associated with Microsoft telemetry, event tracking, and cloud services hosted on Azure.

5) Create simplified diagram showing application traffic flows

Diagram Highlights:

• Left side: Source IPs (e.g., your device)
• Right side: Destination IPs labeled with their service type (e.g., Webex, Microsoft, Google)
• Flow width: Represents the number of packets exchanged

Conclusion

Simply put, using Co-Pilot for network analysis was an agonizing experience. It’s nowhere near ready to assist network engineers in making sense of network data. From the very first prompt where I had to explicitly tell it to “analyze network data” to the incomprehensible “gobble-de-goo” diagram it eventually produced, the entire process felt more frustrating than functional.

Throughout my evaluation, I was unable to identify a single scenario in which Co-Pilot delivered meaningful assistance or demonstrated performance superior to ChatGPT. The model consistently failed to interpret packet captures accurately, frequently misclassifying protocol fields and misinterpreting fundamental networking terminology. In several test cases, Co-Pilot produced generic or contextually irrelevant summaries that added little analytical value.

That said, Co-Pilot does shine in other areas. Its AI-powered assistance across Microsoft 365 applications, automating routine Office tasks and offering contextual suggestions in Word, Excel, and Outlook is genuinely impressive. But for analysing network traffic? It’s simply not there yet.

Final Thoughts, ChatGPT dramatically outperforms Co-Pilot when it comes to analysing network data. It saves massive amounts of time and effort by parsing complex information and presenting it in a clear, easy-to-read format that can be shared effortlessly with colleagues.