#Microsoft remote desktop protocol port professional
#Microsoft remote desktop protocol port series
#Microsoft remote desktop protocol port windows

Rdesktop is an open source application for connecting to Microsoft Terminal Server services using RDP.

#Microsoft remote desktop protocol port series

ITU-T T Series Recommendation T.125 - Multipoint communication service protocol specification ITU-T X Series Recommendation X.224 - Open Systems Interconnection - Protocol for providing the connection-mode transport service Microsoft Network Monitor 3 provides some clues as to what other standards RDP is based on. ITU-T T Series Recommendation T.128 - Multipoint application sharing - ostensibly, RDP is based on this ITU-T Recommendation for telecommunications. dynamically determines maximum supported key strengthĬlients that do not support 128-bit will not be able to connect.Not sure what happens to earlier clients ie whether it falls back or failsĬlient Compatible - protects data sent from client to server

#Microsoft remote desktop protocol port windows

High - protects data sent from client to server and data sent from server to clientġ28-bit if Windows 2000 server to Windows 2000 or higher client Medium - protects data sent from client to server and data sent from server to client Low - protects data sent from client to serverĥ6-bit if Windows 2000 server to Windows 2000 or higher clientĤ0-bit if Windows 2000 server to pre-Windows 2000 client Notes about Terminal Server Services Encryption Settings You can filter RDP protocols while capturing, as it's always using TCP port 3389.Ĭapture only the RDP based traffic: tcp port 3389 The following display references may also prove useful: The following filter will include the conference set up and establishment of virtual channels, as well as the RDP conversation. You may also use display filters based on the protocols on top of which RDP is built. However, RDP protocols use TCP port 3389. There are no built-in display filters specifically for RDP. the client authenticating to the server,.

the client initiating a connection to the server,.

#Microsoft remote desktop protocol port professional

Use standard Windows authentication is enabledĬapture on 192.168.235.3 through IPSec VPN tunnel with IP 172.21.128.16 as client to 10.226.24.52 as server with a capture filter of ip host 10.226.24.52Ĭlient system is Windows XP Professional with Service Pack 2 running Microsoft Remote Desktop Connection with 128-bit encryption.

Server system is Windows 2000 Server with Service Pack 4 running Microsoft Terminal Services. The client initiating a connection to the server,Ĭapture on 10.226.41.226 as client to 10.226.29.74 as server with a capture filter of ip host 10.226.29.74 Server system is Windows Server 2003 with Service Pack 1 running Microsoft Terminal Services. Example capture fileĬapture on 10.226.41.226 as client to 10.226.24.52 as server with a capture filter of ip host 10.226.24.52Ĭlient system is Windows XP Professional with Service Pack 2 running Microsoft Remote Desktop Connection. As yet, it has not proved possible to recover the NTLM keys in order to decrypt the CredSSP encrypted PDUs. The FreeRDP project provides a number of capture files, associated private keys and a detailed analysis of the protocol exchanges on their wiki. The CredSSP documentation states that SPNEGO is used to select between NTLM and Kerberos - but the RDP captures seen to date carry NTLM without any SPNEGO. This is always run under a SSL encrypted session. RDP can also use the Credential Security Support Provider ( CredSSP) protocol to provide authentication information. In order to dissect Enhanced RDP Security SSL, you should configure the SSL dissector with the following: ,3389,tpkt, There is no handling of virtual channel PDUs (beyond the security header) at the moment. If Standard RDP Security is being negotiated, all the PDUs after the SecurityExchangePDU will be encrypted. WiresharkĪ basic RDP dissector exists that can decode most of the PDUs that are exchanged during the connection sequence. The encapsulated RDP will never negotiate any Standard RDP Security, so all of these SSL protected PDUS should be able to be dissected (subject to be able to do applicable decompression).Įxample capture files are detailed below. The SSL dissector may be used to handle the SSL and then hand off the encapsulated data to the RDP dissector. SSL: SSL may be used with Enhanced RDP security, and is used on the same port as standard RDP. TPKT runs atop TCP when used to transport RDP, the well known TCP port is 3389, rather than the normal TPKT port 102. TPKT: Typically, RDP uses TPKT as its transport protocol. See Wikipedia entry Protocol dependencies RDP is a proprietary protocol developed by Microsoft for their Terminal Server services.