Wireshark-users: Re: [Wireshark-users] Capture RDP pattern
From: "Giles Coochey" <gcoochey@xxxxxxxxxxx>
Date: Tue, 20 Nov 2007 16:29:31 +0100
> 
> Hello,
> 
> I am new user of wireshark. My supervisor asked me to capture the
pattern
> of RDP using wireshark. I looked through internet and dint find any
clear
> answer. I hope you guys would help me. This is the first time I am
trying
> to capture any protocol pattern. I don't know where to look for in
> wireshark to determine the pattern for a protocol to build a regular
> expression from it.
> Thank you in advance.

Check out: http://wiki.wireshark.org/RDP

This thread may be of interest to you:
http://www.mail-archive.com/wireshark-dev@xxxxxxxxxxxxx/msg07460.html