Alas, very soon after posting the question, I found what seems to be the root cause. The RDP client seems to be oblivious to a server side socket close, due to bad credentials.
When I put in the correct password, it succeeds!
I hope other people benefit from this Q&A. A case of what looks like a connection problem is actually stupidity in the RDP client.
Here are the last two packets from a
09:29:05.977126 IP server.3389 > client.65355: F 1292:1292(0) ack 1438 win 7965
09:29:05.978195 IP client.65355 > server.3389: . ack 1293 win 16229
The server (actually a port forwarding server, not the Windows machine) has send a FIN packet, indicated by the
F. The client TCP stack acks it, but the application remains oblivious to the one-way close and keeps displaying the connection attempt dialog box.
I have reproduced it several times. When I disconnect and try to reconnect with the wrong password, it hangs. Right password, and it proceeds. Maybe in another ten years they will get RDP right.
P.S. the other client not displaying the behavior is a free app for Android.