I wrote a man-in-the-middle recording for RDP way back when. We did recording for both, RDP is much more sophisticated. Besides using a TLS style encryption (V

I wrote a man-in-the-middle recording for RDP way back when. We did recording for both, RDP is much more sophisticated. Besides using a TLS style encryption (VNC at the time had none). RDP tries as hard as possible to not just send bitmaps. It first shares what fonts it wants to use, then a cache of bitmaps from the previous session (for the wallpaper for example). When Windows move it doesn't send bitmap updates, it sends window updates and tells the client to paint a rect, then draw fonts, etc.. That said, it's a bear of a protocol with countless versions and "speed mode" hacks that bypass the layered protocol setup, tons of weird features, etc..