Wireshark · Display Filter Reference: Remote Desktop Protocol

Field name	Description	Type	Versions
rdp.action	action	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.alternateShell	alternateShell	Character string	1.8.0 to 4.4.2
rdp.alternateShell.length	cbAlternateShell	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.autoReconnectCookie	autoReconnectCookie	Byte sequence	1.8.0 to 4.4.2
rdp.autoReconnectCookie.length	cbAutoReconnectLen	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.bandwidth.headerlen	HeaderLength	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.bandwidth.measure.len	Payload length	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.bandwidth.measure.payload	Payload data	Byte sequence	3.6.0 to 4.4.2
rdp.bandwidth.reqtype	Request type	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.bandwidth.resptype	Response type	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.bandwidth.sequencenumber	Sequence number	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.bandwidth.typeid	HeaderTypeId	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.bBitMask	bBitMask	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.Bias	Bias	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.Bias.daylight	DaylightBias	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.Bias.standard	StandardBias	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.blobData	blobData	Byte sequence	1.8.0 to 4.4.2
rdp.bMsgType	bMsgType	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.bVersion	bVersion	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.capability.rail.dockedlangbar	DOCKED_LANGBAR	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.handshakeex	HANDSHAKE_EX	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.hideminimized	HIDE_MINIMIZED_APPS	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.langimesync	LANGUAGE_IME_SYNC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.servertoclientimesync	SERVER_TO_CLIENT_IME_SYNC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.shellintegration	SHELL_INTEGRATION	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.supported	SUPPORTED	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.supportedlevel	RailSupportLevel	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capability.rail.windowcloaking	WINDOW_CLOAKING	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.capabilityData	capabilityData	Label	1.8.0 to 4.4.2
rdp.capabilitySet	capabilitySet	Label	1.8.0 to 4.4.2
rdp.capabilitySetType	capabilitySetType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.channelCount	channelCount	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.channelDef	channelDef	Label	1.8.0 to 4.4.2
rdp.channelDefArray	channelDefArray	Label	1.8.0 to 4.4.2
rdp.channelFlag.first	channelFlagFirst	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelFlag.last	channelFlagLast	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelFlag.resume	channelFlagResume	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelFlag.showProtocol	channelFlagShowProtocol	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelFlag.suspend	channelFlagSuspend	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelFlags	channelFlags	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelIdArray	channelIdArray	Label	1.8.0 to 4.4.2
rdp.channelPacket.atFront	channelPacketAtFront	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelPacket.compressed	channelPacketCompressed	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelPacket.compressionType	channelPacketCompressionType	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelPacket.flushed	channelPacketFlushed	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.channelPDUHeader	channelPDUHeader	Byte sequence	1.8.0 to 4.4.2
rdp.client.address	clientAddress	Character string	1.8.0 to 4.4.2
rdp.client.address.length	cbClientAddress	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.client.addressFamily	clientAddressFamily	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.client.build	clientBuild	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.client.cluster.redirectedsmartcard	redirectedSmartcard	Unsigned integer (32 bits)	4.4.0 to 4.4.2
rdp.client.cluster.redirectionSupported	redirectionSupported	Unsigned integer (32 bits)	4.4.0 to 4.4.2
rdp.client.cluster.redirectionversion	SessionRedirectionVersion	Unsigned integer (32 bits)	4.4.0 to 4.4.2
rdp.client.cluster.sessionidvalid	sessionIdValid	Unsigned integer (32 bits)	4.4.0 to 4.4.2
rdp.client.clusterData	clientClusterData	Label	1.8.0 to 4.4.2
rdp.client.coreData	clientCoreData	Label	1.8.0 to 4.4.2
rdp.client.digProductId	clientDigProductId	Character string	1.8.0 to 4.4.2
rdp.client.dir	clientDir	Character string	1.8.0 to 4.4.2
rdp.client.dir.length	cbClientDir	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.client.monitorData	clientMonitorData	Label	2.0.0 to 4.4.2
rdp.client.monitorDefData	clientMonitorDefData	Label	3.0.0 to 4.4.2
rdp.client.monitorExData	clientMonitorExData	Label	2.0.0 to 4.4.2
rdp.client.msgChannelData	clientMsgChannelData	Label	2.0.0 to 4.4.2
rdp.client.multiTransportData	clientMultiTransportData	Label	2.0.0 to 4.4.2
rdp.client.name	clientName	Character string	1.8.0 to 4.4.2
rdp.client.networkData	clientNetworkData	Label	1.8.0 to 4.4.2
rdp.client.productId	clientProductId	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.client.requestedProtocols	clientRequestedProtocols	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.client.securityData	clientSecurityData	Label	1.8.0 to 4.4.2
rdp.client.sessionId	clientSessionId	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.client.timeZone	clientTimeZone	Label	1.8.0 to 4.4.2
rdp.clientData	ClientData	Label	1.8.0 to 4.4.2
rdp.clientInfoPDU	clientInfoPDU	Label	1.8.0 to 4.4.2
rdp.clusterFlags	clusterFlags	Unsigned integer (32 bits)	1.10.0 to 4.4.2
rdp.codePage	codePage	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.colorDepth	colorDepth	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.compressedData	compressedData	Label	1.8.0 to 1.8.15
rdp.compressedLength	compressedLength	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.compressedType	compressedType	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.compressedType.atFront	compressedTypeAtFront	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.compressedType.compressed	compressedTypeCompressed	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.compressedType.flushed	compressedTypeFlushed	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.compressedType.type	compressedTypeType	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.connectionType	connectionType	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.controlId	controlId	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.correlationInfo.correlationId	correlationId	Byte sequence	2.2.0 to 4.4.2
rdp.correlationInfo.flags	Flags	Unsigned integer (8 bits)	2.2.0 to 4.4.2
rdp.correlationInfo.reserved	Reserved	Byte sequence	2.2.0 to 4.4.2
rdp.dataSignature	dataSignature	Byte sequence	1.8.0 to 4.4.2
rdp.Date.Daylight	DaylightDate	Label	1.8.0 to 4.4.2
rdp.Date.Standard	StandardDate	Label	1.8.0 to 4.4.2
rdp.desktop.height	desktopHeight	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.desktop.width	desktopWidth	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.domain	domain	Character string	1.8.0 to 4.4.2
rdp.domain.length	cbDomain	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.dynamicdaylighttimedisabled	dynamicDaylightTimeDisabled	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.dynamicdsttimezone	dynamicDSTTimeZoneKeyName	Character string	4.4.0 to 4.4.2
rdp.dynamicdsttimezone.length	cbDynamicDSTTimeZoneKeyName	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.earlyCapabilityFlags	earlyCapabilityFlags	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.encryptedClientRandom	encryptedClientRandom	Byte sequence	1.8.0 to 4.4.2
rdp.encryptedData	encryptedData	Label	1.8.0 to 4.4.2
rdp.encryptionLevel	encryptionLevel	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.encryptionMethod	encryptionMethod	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.encryptionMethods	encryptionMethods	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.entrySize	entrySize	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.errorCode	errorCode	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.extEncryptionMethods	extEncryptionMethods	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.fastpath.action	Action	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.clienteventcode	Code	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.eventflags	Flags	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.eventheader	EventHeaderCode	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.flags	flags	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.header	Header	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.numevents	numEvents	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.numevents2	NumEvents2	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.qoe.timestamp	Timestamp	Unsigned integer (32 bits)	4.0.0 to 4.4.2
rdp.fastpath.reserved	Reserved	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.scancode.extended	Extended	Boolean	4.0.0 to 4.4.2
rdp.fastpath.scancode.extended1	Extended1	Boolean	4.0.0 to 4.4.2
rdp.fastpath.scancode.keycode	KeyCode	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.scancode.release	Release	Boolean	4.0.0 to 4.4.2
rdp.fastpath.server.compressionflags	CompressionFlags	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.server.compressionflags.atfront	At front	Boolean	4.0.0 to 4.4.2
rdp.fastpath.server.compressionflags.compressed	Compressed	Boolean	4.0.0 to 4.4.2
rdp.fastpath.server.compressionflags.flushed	Flushed	Boolean	4.0.0 to 4.4.2
rdp.fastpath.server.compressiontype	CompressionType	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.server.size	Size	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.fastpath.servercompression	Compression	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.serverfragmentation	Fragmentation	Unsigned integer (8 bits)	4.0.0 to 4.4.2
rdp.fastpath.sync.capslock	CapsLock	Boolean	4.0.0 to 4.4.2
rdp.fastpath.sync.kanalock	ScrollLock	Boolean	4.0.0 to 4.4.2
rdp.fastpath.sync.numlock	NumLock	Boolean	4.0.0 to 4.4.2
rdp.fastpath.sync.scrolllock	ScrollLock	Boolean	4.0.0 to 4.4.2
rdp.fastpath.unicode.code	unicodeCode	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.fastpath.unicode.release	Release	Boolean	4.0.0 to 4.4.2
rdp.fastpathPDULength	fastpathPDULength	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.fipsLength	fipsLength	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.fipsVersion	fipsVersion	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.flags	flags	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.autodetectreq	autodetect request	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.flags.autodetectresp	autodetect response	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.flags.encrypt	flagsEncrypt	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.flagshivalid	flagsHiValid	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.heartbeat	heartbeat	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.flags.ignoreseqno	flagsIgnoreSeqno	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.licenseencrypt	flagsLicenseEncrypt	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.pkt	flagsPkt	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.resetseqno	flagsResetSeqno	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.securechecksum	flagsSecureChecksum	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.flags.transportreq	multiTransport request	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.flags.transportrsp	transport response	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.flagsHi	flagsHi	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.grantId	grantId	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.header.length	headerLength	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.header.type	headerType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.heartbeat.count1	Count1	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.heartbeat.count2	Count2	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.heartbeat.period	Period	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.heartbeat.reserved	reserved	Unsigned integer (8 bits)	3.6.0 to 4.4.2
rdp.highColorDepth	highColorDepth	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.imeFileName	imeFileName	Byte sequence	1.8.0 to 4.4.2
rdp.Key1	Key1	Unsigned integer (32 bits)	1.8.0 to 1.8.15
rdp.Key2	Key2	Unsigned integer (32 bits)	1.8.0 to 1.8.15
rdp.keyboard.functionkey	keyboardFunctionKey	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.keyboard.subtype	keyboardSubType	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.keyboard.type	keyboardType	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.keyboardLayout	keyboardLayout	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.length	length	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.lengthCapability	lengthCapability	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.lengthCombinedCapabilities	lengthCombinedCapabilities	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.lengthSourceDescriptor	lengthSourceDescriptor	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.mapFlags	mapFlags	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.mapFlags.fontMapFirst	fontMapFirst	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.mapFlags.fontMapLast	fontMapLast	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.MCSChannelId	MCSChannelId	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.messageData	MessageData	Label	3.6.0 to 4.4.2
rdp.messageType	messageType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.monitorAttributeSize	monitorAttributeSize	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rdp.monitorCount	monitorCount	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rdp.monitorDef.bottom	bottom	Signed integer (32 bits)	3.0.0 to 4.4.2
rdp.monitorDef.flags	flags	Unsigned integer (32 bits)	3.0.0 to 4.4.2
rdp.monitorDef.left	left	Signed integer (32 bits)	3.0.0 to 4.4.2
rdp.monitorDef.right	right	Signed integer (32 bits)	3.0.0 to 4.4.2
rdp.monitorDef.top	top	Signed integer (32 bits)	3.0.0 to 4.4.2
rdp.monitorExFlags	monitorExFlags	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rdp.monitorFlags	monitorFlags	Unsigned integer (32 bits)	3.0.0 to 4.4.2
rdp.msgChannelFlags	msgChannelFlags	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rdp.msgChannelId	msgChannelId	Unsigned integer (16 bits)	2.0.0 to 4.4.2
rdp.mtreq.protocol	Protocol	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.mtreq.requestid	Request id	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.mtreq.reserved	Reserved	Unsigned integer (16 bits)	3.6.0 to 4.4.2
rdp.mtreq.securitycookie	Security cookie	Byte sequence	3.6.0 to 4.4.2
rdp.mtresp.hrresponse	hrResponse	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.mtresp.requestid	Request id	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.multiTransportFlags	multiTransportFlags	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rdp.name	name	Character string	1.8.0 to 4.4.2
rdp.Name.Daylight	DaylightName	Character string	1.8.0 to 4.4.2
rdp.Name.Standard	StandardName	Character string	1.8.0 to 4.4.2
rdp.neg_len.invalid	Invalid length	Label	2.2.0 to 4.4.2
rdp.neg_length	Length	Unsigned integer (16 bits)	2.2.0 to 4.4.2
rdp.neg_type	Type	Unsigned integer (8 bits)	2.2.0 to 4.4.2
rdp.negFailure.failureCode	failureCode	Unsigned integer (32 bits)	2.2.0 to 4.4.2
rdp.negReq.flags	Flags	Unsigned integer (8 bits)	2.2.0 to 4.4.2
rdp.negReq.flags.correlation_info_present	Correlation info present	Boolean	2.2.0 to 4.4.2
rdp.negReq.flags.redirected_auth_req	Redirected Authentication required	Boolean	4.2.0 to 4.4.2
rdp.negReq.flags.restricted_admin_mode_req	Restricted admin mode required	Boolean	2.2.0 to 4.4.2
rdp.negReq.requestedProtocols	requestedProtocols	Unsigned integer (32 bits)	2.2.0 to 4.4.2
rdp.negReq.requestedProtocols.hybrid	CredSSP supported	Boolean	2.2.0 to 4.4.2
rdp.negReq.requestedProtocols.hybrid_ex	CredSSP with Early User Authorization Result PDU supported	Boolean	2.2.0 to 4.4.2
rdp.negReq.requestedProtocols.rdstls	RDSTLS supported	Boolean	3.6.0 to 4.4.2
rdp.negReq.requestedProtocols.ssl	TLS security supported	Boolean	2.2.0 to 4.4.2
rdp.negReq.selectedProtocol	selectedProtocol	Unsigned integer (32 bits)	2.2.0 to 4.4.2
rdp.negReq.selectedProtocol.hybrid	CredSSP selected	Boolean	2.2.0 to 3.4.16
rdp.negReq.selectedProtocol.hybrid_ex	Early User Authorization Result PDU selected	Boolean	2.2.0 to 3.4.16
rdp.negReq.selectedProtocol.ssl	TLS security selected	Boolean	2.2.0 to 3.4.16
rdp.negRsp.flags	Flags	Unsigned integer (8 bits)	2.2.0 to 4.4.2
rdp.negRsp.flags.dynvc_gfx_protocol_supported	Graphics Pipeline Extension Protocol supported	Boolean	2.2.0 to 4.4.2
rdp.negRsp.flags.extended_client_data_supported	Extended Client Data Blocks supported	Boolean	2.2.0 to 4.4.2
rdp.negRsp.flags.restricted_admin_mode_supported	Restricted admin mode supported	Boolean	2.2.0 to 4.4.2
rdp.negRsp.flags.restricted_authentication_mode_supported	Restricted authentication mode supported	Boolean	3.6.0 to 4.4.2
rdp.networkcharacteristics.averagertt	Average RTT	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.networkcharacteristics.bandwidth	Bandwidth	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.networkcharacteristics.basertt	Base RTT	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.not_correlation_info	What follows RDP Negotiation Request is not an RDP Correlation Info	Label	2.2.0 to 4.4.2
rdp.notYetImplemented	notYetImplemented	Label	1.8.0 to 4.4.2
rdp.numberCapabilities	numberCapabilities	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numberEntries	numberEntries	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numEntriesCache0	numEntriesCache0	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numEntriesCache1	numEntriesCache1	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numEntriesCache2	numEntriesCache2	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numEntriesCache3	numEntriesCache3	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.numEntriesCache4	numEntriesCache4	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.optionFlags	optionFlags	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options	options	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.compress	compress	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.compress.rdp	compressRDP	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.encrypt.cs	encryptCS	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.encrypt.rdp	encryptRDP	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.encrypt.sc	encryptSC	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.initialized	optionsInitialized	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.priority.high	priorityHigh	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.priority.low	priorityLow	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.priority.med	priorityMed	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.remotecontrolpersistent	remoteControlPersistent	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.options.showprotocol	showProtocol	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.OriginatorId	originatorId	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.Pad	Pad	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pad1	pad1	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.pad1octet	pad1octet	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.Pad2	Pad2	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.pad2Octets	pad2Octets	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.Pad3	Pad3	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.padlen	padlen	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.password	password	Character string	1.8.0 to 4.4.2
rdp.password.length	cbPassword	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduSource	pduSource	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduType	pduType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduType.type	pduTypeType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduType.versionHigh	pduTypeVersionHigh	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduType.versionLow	pduTypeVersionLow	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.pduType2	pduType2	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.performanceFlags	performanceFlags	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.pointer.xpos	xPos	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointer.ypos	yPos	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerflags	pointerFlags	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerflags.button1	Button1	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.button2	Button2	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.button3	Button3	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.down	Down	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.hwheel	Horizontal wheel	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.move	Move	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.wheel	Wheel	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.wheelnegative	Wheel negative	Boolean	4.0.0 to 4.4.2
rdp.pointerflags.wheelrotation	Wheel rotation	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerx.xpos	xPos	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerx.ypos	yPos	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerxflags	PointerFlags	Unsigned integer (16 bits)	4.0.0 to 4.4.2
rdp.pointerxflags.button1	Button1	Boolean	4.0.0 to 4.4.2
rdp.pointerxflags.button2	Button2	Boolean	4.0.0 to 4.4.2
rdp.pointerxflags.down	Down	Boolean	4.0.0 to 4.4.2
rdp.postBeta2ColorDepth	postBeta2ColorDepth	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.rdstls.datatype	Data type	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.domain	Domain	Character string	4.2.0 to 4.4.2
rdp.rdstls.domainlen	Domain length	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.password	Password	Byte sequence	4.2.0 to 4.4.2
rdp.rdstls.passwordlen	Password length	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.pdutype	Pdu type	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.reconnectcookie	AutoReconnect cookie	Byte sequence	4.2.0 to 4.4.2
rdp.rdstls.reconnectcookielen	AutoReconnect cookie length	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.redirectionguid	redirectionGUID	Character string	4.2.0 to 4.4.2
rdp.rdstls.redirectionguidlen	redirectionGUID length	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.resultcode	Result code	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.rdstls.sessionid	SessionId	Unsigned integer (32 bits)	4.2.0 to 4.4.2
rdp.rdstls.supportedversions	Supported versions	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.username	Username	Character string	4.2.0 to 4.4.2
rdp.rdstls.usernamelen	Username length	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.rdstls.version	Version	Unsigned integer (16 bits)	4.2.0 to 4.4.2
rdp.redirectedSessionId	redirectedSessionId	Unsigned integer (32 bits)	1.10.0 to 4.4.2
rdp.relmouse.deltax	deltaX	Signed integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.deltay	deltaY	Signed integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags	Flags	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.button1	Button1	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.button2	Button2	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.button3	Button3	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.down	Down	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.move	Move	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.xbutton1	XButton1	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.relmouse.flags.xbutton2	XButton2	Unsigned integer (16 bits)	4.4.0 to 4.4.2
rdp.reserved1	reserved1	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.reserved2	reserved2	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.rt_cookie	Routing Token/Cookie	Character string	2.2.0 to 4.4.2
rdp.rttmeasure.bytecount	Byte count	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.rttmeasure.timedelta	Time delta	Unsigned integer (32 bits)	3.6.0 to 4.4.2
rdp.SASSequence	SASSequence	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.securityExchangePDU	securityExchangePDU	Label	1.8.0 to 4.4.2
rdp.sendData	SendData	Label	1.8.0 to 4.4.2
rdp.serialNumber	serialNumber	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.server.coreData	serverCoreData	Label	1.8.0 to 4.4.2
rdp.server.msgChannelData	serverMsgChannelData	Label	2.0.0 to 4.4.2
rdp.server.multiTransportData	serverMultiTransportData	Label	2.0.0 to 4.4.2
rdp.server.networkData	serverNetworkData	Label	1.8.0 to 4.4.2
rdp.server.securityData	serverSecurityData	Label	1.8.0 to 4.4.2
rdp.serverCertificate	serverCertificate	Byte sequence	1.8.0 to 4.4.2
rdp.serverCertLen	serverCertLen	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.serverData	ServerData	Label	1.8.0 to 4.4.2
rdp.serverRandom	serverRandom	Byte sequence	1.8.0 to 4.4.2
rdp.serverRandomLen	serverRandomLen	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.serverSelectedProtocol	serverSelectedProtocol	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.serverstatus.code	statusCode	Unsigned integer (32 bits)	4.4.0 to 4.4.2
rdp.sessionId	sessionId	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.shareControlHeader	shareControlHeader	Byte sequence	1.8.0 to 4.4.2
rdp.shareId	shareId	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.sourceDescriptor	sourceDescriptor	Character string	1.8.0 to 4.4.2
rdp.stateTransition	stateTransition	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rdp.streamId	streamId	Unsigned integer (8 bits)	1.8.0 to 4.4.2
rdp.supportedColorDepths	supportedColorDepths	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.targetUser	targetUser	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalEntriesCache0	totalEntriesCache0	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalEntriesCache1	totalEntriesCache1	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalEntriesCache2	totalEntriesCache2	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalEntriesCache3	totalEntriesCache3	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalEntriesCache4	totalEntriesCache4	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalLength	totalLength	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.totalNumberEntries	totalNumberEntries	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.uncompressedLength	uncompressedLength	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.unknownData	unknownData	Label	1.8.0 to 1.8.15
rdp.unknownData.client	clientUnknownData	Label	1.8.0 to 4.4.2
rdp.unknownData.server	serverUnknownData	Label	1.8.0 to 4.4.2
rdp.unused	Unused	Label	1.10.0 to 2.6.20
rdp.userName	userName	Character string	1.8.0 to 4.4.2
rdp.userName.length	cbUserName	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.validClientLicenseData	validClientLicenseData	Label	1.8.0 to 4.4.2
rdp.version.major	versionMajor	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.version.minor	versionMinor	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.virtualChannelData	virtualChannelData	Byte sequence	1.8.0 to 4.4.2
rdp.wBlobLen	wBlobLen	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wBlobType	wBlobType	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wDay	wDay	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wDayOfWeek	wDayOfWeek	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wHour	wHour	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wMilliseconds	wMilliseconds	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wMinute	wMinute	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wMonth	wMonth	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wMsgSize	wMsgSize	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.workingDir	workingDir	Character string	1.8.0 to 4.4.2
rdp.workingDir.length	cbWorkingDir	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wSecond	wSecond	Unsigned integer (16 bits)	1.8.0 to 4.4.2
rdp.wYear	wYear	Unsigned integer (16 bits)	1.8.0 to 4.4.2