Display Filter Reference: Remote Desktop Protocol
Protocol field name: rdp
Versions: 1.8.0 to 4.0.3
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| rdp.action | action | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.alternateShell | alternateShell | Character string | 1.8.0 to 4.0.3 |
| rdp.alternateShell.length | cbAlternateShell | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.autoReconnectCookie | autoReconnectCookie | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.autoReconnectCookie.length | cbAutoReconnectLen | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.bandwidth.headerlen | HeaderLength | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.bandwidth.measure.len | Payload length | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.bandwidth.measure.payload | Payload data | Byte sequence | 3.6.0 to 4.0.3 |
| rdp.bandwidth.reqtype | Request type | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.bandwidth.resptype | Response type | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.bandwidth.sequencenumber | Sequence number | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.bandwidth.typeid | HeaderTypeId | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.bBitMask | bBitMask | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.Bias | Bias | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.Bias.daylight | DaylightBias | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.Bias.standard | StandardBias | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.blobData | blobData | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.bMsgType | bMsgType | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.bVersion | bVersion | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.capabilityData | capabilityData | Label | 1.8.0 to 4.0.3 |
| rdp.capabilitySet | capabilitySet | Label | 1.8.0 to 4.0.3 |
| rdp.capabilitySetType | capabilitySetType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelCount | channelCount | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelDef | channelDef | Label | 1.8.0 to 4.0.3 |
| rdp.channelDefArray | channelDefArray | Label | 1.8.0 to 4.0.3 |
| rdp.channelFlag.first | channelFlagFirst | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelFlag.last | channelFlagLast | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelFlag.resume | channelFlagResume | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelFlag.showProtocol | channelFlagShowProtocol | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelFlag.suspend | channelFlagSuspend | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelFlags | channelFlags | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelIdArray | channelIdArray | Label | 1.8.0 to 4.0.3 |
| rdp.channelPacket.atFront | channelPacketAtFront | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelPacket.compressed | channelPacketCompressed | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelPacket.compressionType | channelPacketCompresssionType | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelPacket.flushed | channelPacketFlushed | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.channelPDUHeader | channelPDUHeader | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.client.address | clientAddress | Character string | 1.8.0 to 4.0.3 |
| rdp.client.address.length | cbClientAddress | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.addressFamily | clientAddressFamily | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.build | clientBuild | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.clusterData | clientClusterData | Label | 1.8.0 to 4.0.3 |
| rdp.client.coreData | clientCoreData | Label | 1.8.0 to 4.0.3 |
| rdp.client.digProductId | clientDigProductId | Character string | 1.8.0 to 4.0.3 |
| rdp.client.dir | clientDir | Character string | 1.8.0 to 4.0.3 |
| rdp.client.dir.length | cbClientDir | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.monitorData | clientMonitorData | Label | 2.0.0 to 4.0.3 |
| rdp.client.monitorDefData | clientMonitorDefData | Label | 3.0.0 to 4.0.3 |
| rdp.client.monitorExData | clientMonitorExData | Label | 2.0.0 to 4.0.3 |
| rdp.client.msgChannelData | clientMsgChannelData | Label | 2.0.0 to 4.0.3 |
| rdp.client.multiTransportData | clientMultiTransportData | Label | 2.0.0 to 4.0.3 |
| rdp.client.name | clientName | Character string | 1.8.0 to 4.0.3 |
| rdp.client.networkData | clientNetworkData | Label | 1.8.0 to 4.0.3 |
| rdp.client.productId | clientProductId | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.requestedProtocols | clientRequestedProtocols | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.client.securityData | clientSecurityData | Label | 1.8.0 to 4.0.3 |
| rdp.client.sessionId | clientSessionId | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.client.timeZone | clientTimeZone | Label | 1.8.0 to 4.0.3 |
| rdp.clientData | ClientData | Label | 1.8.0 to 4.0.3 |
| rdp.clientInfoPDU | clientInfoPDU | Label | 1.8.0 to 4.0.3 |
| rdp.clusterFlags | clusterFlags | Unsigned integer (4 bytes) | 1.10.0 to 4.0.3 |
| rdp.codePage | codePage | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.colorDepth | colorDepth | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.compressedData | compressedData | Label | 1.8.0 to 1.8.15 |
| rdp.compressedLength | compressedLength | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.compressedType | compressedType | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.compressedType.atFront | compressedTypeAtFront | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.compressedType.compressed | compressedTypeCompressed | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.compressedType.flushed | compressedTypeFlushed | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.compressedType.type | compressedTypeType | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.connectionType | connectionType | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.controlId | controlId | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.correlationInfo.correlationId | correlationId | Byte sequence | 2.2.0 to 4.0.3 |
| rdp.correlationInfo.flags | Flags | Unsigned integer (1 byte) | 2.2.0 to 4.0.3 |
| rdp.correlationInfo.reserved | Reserved | Byte sequence | 2.2.0 to 4.0.3 |
| rdp.dataSignature | dataSignature | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.Date.Daylight | DaylightDate | Label | 1.8.0 to 4.0.3 |
| rdp.Date.Standard | StandardDate | Label | 1.8.0 to 4.0.3 |
| rdp.desktop.height | desktopHeight | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.desktop.width | desktopWidth | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.domain | domain | Character string | 1.8.0 to 4.0.3 |
| rdp.domain.length | cbDomain | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.earlyCapabilityFlags | earlyCapabilityFlags | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.encryptedClientRandom | encryptedClientRandom | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.encryptedData | encryptedData | Label | 1.8.0 to 4.0.3 |
| rdp.encryptionLevel | encryptionLevel | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.encryptionMethod | encryptionMethod | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.encryptionMethods | encryptionMethods | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.entrySize | entrySize | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.errorCode | errorCode | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.extEncryptionMethods | extEncryptionMethods | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.fastpath.action | Action | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.clienteventcode | Code | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.eventflags | Flags | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.eventheader | EventHeaderCode | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.flags | flags | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.header | Header | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.numevents | numEvents | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.numevents2 | NumEvents2 | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.qoe.timestamp | Timestamp | Unsigned integer (4 bytes) | 4.0.0 to 4.0.3 |
| rdp.fastpath.reserved | Reserved | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.scancode.extended | Extended | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.scancode.extended1 | Extended1 | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.scancode.keycode | KeyCode | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.scancode.release | Release | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.compressionflags | CompressionFlags | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.compressionflags.atfront | At front | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.compressionflags.compressed | Compressed | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.compressionflags.flushed | At front | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.compressiontype | CompressionType | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.server.size | Size | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.fastpath.servercompression | Compression | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.serverfragmentation | Fragmentation | Unsigned integer (1 byte) | 4.0.0 to 4.0.3 |
| rdp.fastpath.sync.capslock | CapsLock | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.sync.kanalock | ScrollLock | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.sync.numlock | NumLock | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.sync.scrolllock | ScrollLock | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpath.unicode.code | unicodeCode | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.fastpath.unicode.release | Release | Boolean | 4.0.0 to 4.0.3 |
| rdp.fastpathPDULength | fastpathPDULength | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.fipsLength | fipsLength | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.fipsVersion | fipsVersion | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.flags | flags | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.autodetectreq | autodetect request | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.flags.autodetectresp | autodetect response | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.flags.encrypt | flagsEncrypt | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.flagshivalid | flagsHiValid | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.heartbeat | heartbeat | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.flags.ignoreseqno | flagsIgnoreSeqno | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.licenseencrypt | flagsLicenseEncrypt | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.pkt | flagsPkt | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.resetseqno | flagsResetSeqno | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.securechecksum | flagsSecureChecksum | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.flags.transportreq | multiTransport request | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.flags.transportrsp | transport response | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.flagsHi | flagsHi | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.grantId | grantId | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.header.length | headerLength | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.header.type | headerType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.heartbeat.count1 | Count1 | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.heartbeat.count2 | Count2 | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.heartbeat.period | Period | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.heartbeat.reserved | reserved | Unsigned integer (1 byte) | 3.6.0 to 4.0.3 |
| rdp.highColorDepth | highColorDepth | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.imeFileName | imeFileName | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.Key1 | Key1 | Unsigned integer (4 bytes) | 1.8.0 to 1.8.15 |
| rdp.Key2 | Key2 | Unsigned integer (4 bytes) | 1.8.0 to 1.8.15 |
| rdp.keyboard.functionkey | keyboardFunctionKey | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.keyboard.subtype | keyboardSubType | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.keyboard.type | keyboardType | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.keyboardLayout | keyboardLayout | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.length | length | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.lengthCapability | lengthCapability | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.lengthCombinedCapabilities | lengthCombinedCapabilities | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.lengthSourceDescriptor | lengthSourceDescriptor | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.mapFlags | mapFlags | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.mapFlags.fontMapFirst | fontMapFirst | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.mapFlags.fontMapLast | fontMapLast | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.MCSChannelId | MCSChannelId | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.messageData | MessageData | Label | 3.6.0 to 4.0.3 |
| rdp.messageType | messageType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.monitorAttributeSize | monitorAttributeSize | Unsigned integer (4 bytes) | 2.0.0 to 4.0.3 |
| rdp.monitorCount | monitorCount | Unsigned integer (4 bytes) | 2.0.0 to 4.0.3 |
| rdp.monitorDef.bottom | bottom | Signed integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.monitorDef.flags | flags | Unsigned integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.monitorDef.left | left | Signed integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.monitorDef.right | right | Signed integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.monitorDef.top | top | Signed integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.monitorExFlags | monitorExFlags | Unsigned integer (4 bytes) | 2.0.0 to 4.0.3 |
| rdp.monitorFlags | monitorFlags | Unsigned integer (4 bytes) | 3.0.0 to 4.0.3 |
| rdp.msgChannelFlags | msgChannelFlags | Unsigned integer (4 bytes) | 2.0.0 to 4.0.3 |
| rdp.msgChannelId | msgChannelId | Unsigned integer (2 bytes) | 2.0.0 to 4.0.3 |
| rdp.mtreq.protocol | Protocol | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.mtreq.requestid | Request id | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.mtreq.reserved | Reserved | Unsigned integer (2 bytes) | 3.6.0 to 4.0.3 |
| rdp.mtreq.securitycookie | Security cookie | Byte sequence | 3.6.0 to 4.0.3 |
| rdp.mtresp.hrresponse | hrResponse | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.mtresp.requestid | Request id | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.multiTransportFlags | multiTransportFlags | Unsigned integer (4 bytes) | 2.0.0 to 4.0.3 |
| rdp.name | name | Character string | 1.8.0 to 4.0.3 |
| rdp.Name.Daylight | DaylightName | Character string | 1.8.0 to 4.0.3 |
| rdp.Name.Standard | StandardName | Character string | 1.8.0 to 4.0.3 |
| rdp.neg_len.invalid | Invalid length | Label | 2.2.0 to 4.0.3 |
| rdp.neg_length | Length | Unsigned integer (2 bytes) | 2.2.0 to 4.0.3 |
| rdp.neg_type | Type | Unsigned integer (1 byte) | 2.2.0 to 4.0.3 |
| rdp.negFailure.failureCode | failureCode | Unsigned integer (4 bytes) | 2.2.0 to 4.0.3 |
| rdp.negReq.flags | Flags | Unsigned integer (1 byte) | 2.2.0 to 4.0.3 |
| rdp.negReq.flags.correlation_info_present | Correlation info present | Boolean | 2.2.0 to 4.0.3 |
| rdp.negReq.flags.restricted_admin_mode_req | Restricted admin mode required | Boolean | 2.2.0 to 4.0.3 |
| rdp.negReq.requestedProtocols | requestedProtocols | Unsigned integer (4 bytes) | 2.2.0 to 4.0.3 |
| rdp.negReq.requestedProtocols.hybrid | CredSSP supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negReq.requestedProtocols.hybrid_ex | CredSSP with Early User Authorization Result PDU supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negReq.requestedProtocols.rdstls | RDSTLS supported | Boolean | 3.6.0 to 4.0.3 |
| rdp.negReq.requestedProtocols.ssl | TLS security supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negReq.selectedProtocol | selectedProtocol | Unsigned integer (4 bytes) | 2.2.0 to 4.0.3 |
| rdp.negReq.selectedProtocol.hybrid | CredSSP selected | Boolean | 2.2.0 to 3.4.16 |
| rdp.negReq.selectedProtocol.hybrid_ex | Early User Authorization Result PDU selected | Boolean | 2.2.0 to 3.4.16 |
| rdp.negReq.selectedProtocol.ssl | TLS security selected | Boolean | 2.2.0 to 3.4.16 |
| rdp.negRsp.flags | Flags | Unsigned integer (1 byte) | 2.2.0 to 4.0.3 |
| rdp.negRsp.flags.dynvc_gfx_protocol_supported | Graphics Pipeline Extension Protocol supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negRsp.flags.extended_client_data_supported | Extended Client Data Blocks supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negRsp.flags.restricted_admin_mode_supported | Restricted admin mode supported | Boolean | 2.2.0 to 4.0.3 |
| rdp.negRsp.flags.restricted_authentication_mode_supported | Restricted authentication mode supported | Boolean | 3.6.0 to 4.0.3 |
| rdp.networkcharacteristics.averagertt | Average RTT | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.networkcharacteristics.bandwidth | Bandwidth | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.networkcharacteristics.basertt | Base RTT | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.not_correlation_info | What follows RDP Negotiation Request is not an RDP Correlation Info | Label | 2.2.0 to 4.0.3 |
| rdp.notYetImplemented | notYetImplemented | Label | 1.8.0 to 4.0.3 |
| rdp.numberCapabilities | numberCapabilities | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numberEntries | numberEntries | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numEntriesCache0 | numEntriesCache0 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numEntriesCache1 | numEntriesCache1 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numEntriesCache2 | numEntriesCache2 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numEntriesCache3 | numEntriesCache3 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.numEntriesCache4 | numEntriesCache4 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.optionFlags | optionFlags | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options | options | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.compress | compress | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.compress.rdp | compressRDP | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.encrypt.cs | encryptCS | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.encrypt.rdp | encryptRDP | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.encrypt.sc | encryptSC | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.initialized | optionsInitialized | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.priority.high | priorityHigh | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.priority.low | priorityLow | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.priority.med | priorityMed | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.remotecontrolpersistent | remoteControlPersistent | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.options.showprotocol | showProtocol | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.OriginatorId | originatorId | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.Pad | Pad | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pad1 | pad1 | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.pad1octet | pad1octet | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.Pad2 | Pad2 | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.pad2Octets | pad2Octets | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.Pad3 | Pad3 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.padlen | padlen | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.password | password | Character string | 1.8.0 to 4.0.3 |
| rdp.password.length | cbPassword | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduSource | pduSource | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduType | pduType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduType.type | pduTypeType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduType.versionHigh | pduTypeVersionHigh | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduType.versionLow | pduTypeVersionLow | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.pduType2 | pduType2 | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.performanceFlags | performanceFlags | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.pointer.xpos | xPos | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointer.ypos | yPos | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerflags | pointerFlags | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerflags.button1 | Button1 | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.button2 | Button2 | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.button3 | Button3 | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.down | Down | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.hwheel | Horizontal wheel | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.move | Move | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.wheel | Wheel | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.wheelnegative | Wheel negative | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerflags.wheelrotation | Wheel rotation | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerx.xpos | xPos | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerx.ypos | yPos | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerxflags | PointeFlags | Unsigned integer (2 bytes) | 4.0.0 to 4.0.3 |
| rdp.pointerxflags.button1 | Button1 | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerxflags.button2 | Button2 | Boolean | 4.0.0 to 4.0.3 |
| rdp.pointerxflags.down | Down | Boolean | 4.0.0 to 4.0.3 |
| rdp.postBeta2ColorDepth | postBeta2ColorDepth | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.redirectedSessionId | redirectedSessionId | Unsigned integer (4 bytes) | 1.10.0 to 4.0.3 |
| rdp.reserved1 | reserved1 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.reserved2 | reserved2 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.rt_cookie | Routing Token/Cookie | Character string | 2.2.0 to 4.0.3 |
| rdp.rttmeasure.bytecount | Byte count | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.rttmeasure.timedelta | Time delta | Unsigned integer (4 bytes) | 3.6.0 to 4.0.3 |
| rdp.SASSequence | SASSequence | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.securityExchangePDU | securityExchangePDU | Label | 1.8.0 to 4.0.3 |
| rdp.sendData | SendData | Label | 1.8.0 to 4.0.3 |
| rdp.serialNumber | serialNumber | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.server.coreData | serverCoreData | Label | 1.8.0 to 4.0.3 |
| rdp.server.msgChannelData | serverMsgChannelData | Label | 2.0.0 to 4.0.3 |
| rdp.server.multiTransportData | serverMultiTransportData | Label | 2.0.0 to 4.0.3 |
| rdp.server.networkData | serverNetworkData | Label | 1.8.0 to 4.0.3 |
| rdp.server.securityData | serverSecurityData | Label | 1.8.0 to 4.0.3 |
| rdp.serverCertificate | serverCertificate | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.serverCertLen | serverCertLen | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.serverData | ServerData | Label | 1.8.0 to 4.0.3 |
| rdp.serverRandom | serverRandom | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.serverRandomLen | serverRandomLen | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.serverSelectedProtocol | serverSelectedProtocol | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.sessionId | sessionId | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.shareControlHeader | shareControlHeader | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.shareId | shareId | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.sourceDescriptor | sourceDescriptor | Character string | 1.8.0 to 4.0.3 |
| rdp.stateTransition | stateTransition | Unsigned integer (4 bytes) | 1.8.0 to 4.0.3 |
| rdp.streamId | streamId | Unsigned integer (1 byte) | 1.8.0 to 4.0.3 |
| rdp.supportedColorDepths | supportedColorDepths | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.targetUser | targetUser | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalEntriesCache0 | totalEntriesCache0 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalEntriesCache1 | totalEntriesCache1 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalEntriesCache2 | totalEntriesCache2 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalEntriesCache3 | totalEntriesCache3 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalEntriesCache4 | totalEntriesCache4 | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalLength | totalLength | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.totalNumberEntries | totalNumberEntries | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.uncompressedLength | uncompressedLength | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.unknownData | unknownData | Label | 1.8.0 to 1.8.15 |
| rdp.unknownData.client | clientUnknownData | Label | 1.8.0 to 4.0.3 |
| rdp.unknownData.server | serverUnknownData | Label | 1.8.0 to 4.0.3 |
| rdp.unused | Unused | Label | 1.10.0 to 2.6.20 |
| rdp.userName | userName | Character string | 1.8.0 to 4.0.3 |
| rdp.userName.length | cbUserName | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.validClientLicenseData | validClientLicenseData | Label | 1.8.0 to 4.0.3 |
| rdp.version.major | versionMajor | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.version.minor | versionMinor | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.virtualChannelData | virtualChannelData | Byte sequence | 1.8.0 to 4.0.3 |
| rdp.wBlobLen | wBlobLen | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wBlobType | wBlobType | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wDay | wDay | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wDayOfWeek | wDayOfWeek | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wHour | wHour | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wMilliseconds | wMilliseconds | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wMinute | wMinute | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wMonth | wMonth | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wMsgSize | wMsgSize | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.workingDir | workingDir | Character string | 1.8.0 to 4.0.3 |
| rdp.workingDir.length | cbWorkingDir | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wSecond | wSecond | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |
| rdp.wYear | wYear | Unsigned integer (2 bytes) | 1.8.0 to 4.0.3 |