4 ms·
It might be even easier than that, since RDP remotes the screen at the GDI level, so if you're looking at the protocol, you'll see a regular pattern of DrawText
by hamburglar 11y ago
It might be even easier than that, since RDP remotes the screen at the GDI level, so if you're looking at the protocol, you'll see a regular pattern of DrawText calls.
- voltagex_ 11y agoOut of interest, is there something like a Wireshark dissector that'd show this level of detail?
- yuhong 11y agoIt is encrypted I think.
- hamburglar 11y agoyuhong is correct: RDP rides inside a TLS connection (if I recall, pre-Vista didn't use TLS but there was some other encryption scheme). I'm not sure how much work it would be to sniff/log session keys and display the decrypted traffic in a nice format. I've never seen a tool for it. I'd be surprised if Microsoft doesn't have at least some netmon.exe tooling for it but it may not be released.
- peterwwillis 11y agoThere is a dissector, but no, it doesn't show this level of detail.