I just cant find it on wireshark when sniffing the RDP connection..

Can anyone show me how they look and how can I distinguish between them?

Of course it would be encrypted but the main question is how do I know it its a mouse click packet/ keyboard press packet or another one? Is there something different on the header? What is it?


1 Answer 1


Not exactly the answer you were looking for possibly helpful: http://sourceforge.net/projects/rdesktop/files/rdesktop/1.8.1/ the rdesktop project is an open source implementation of remote desktop client for linux. it is open and thus you can inspect the code within. I'm sure it has code for handling input transmission.

  • ty, but I have to see the orginal windows RDC RDP packets..
    – Npv23g
    Mar 15, 2014 at 10:31
  • from my knowledge it was reverse engineered using packet capture. and from my experience using it, it works quite well. on the other hand, you can look at msdn.microsoft.com/en-us/library/hh871750.aspx it has a list of files (zip download) listing all open specifications remote-desktop related.
    – Horatiu
    Mar 15, 2014 at 10:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .