2.2.13.1 Server Redirection Packet (RDP_SERVER_REDIRECTION_PACKET)

The RDP_SERVER_REDIRECTION_PACKET structure contains information to enable a client to reconnect to a session on a specified server. This data is sent to a client in a Redirection PDU to enable load-balancing of Remote Desktop sessions across a collection of machines. For more information about the load balancing of Remote Desktop sessions, see [MSFT-SDLBTS] "Load-Balanced Configurations" and "Revectoring Clients".

Flags (2 bytes): A 16-bit unsigned integer. The server redirection identifier. This field MUST be set to SEC_REDIRECTION_PKT (0x0400).

Length (2 bytes): A 16-bit unsigned integer. The overall length, in bytes, of the Server Redirection Packet structure.

SessionID (4 bytes): A 32-bit unsigned integer. The session identifier to which the client MUST reconnect. This identifier MUST be specified in the RedirectedSessionID field of the Client Cluster Data (section 2.2.1.3.5) if a reconnect attempt takes place. The Client Cluster Data is transmitted as part of the MCS Connect Initial PDU (section 2.2.1.3).

RedirFlags (4 bytes): A 32-bit unsigned integer. A bit field that contains redirection information flags, some of which indicate the presence of additional data at the end of the packet.

Flag	Meaning
LB_TARGET_NET_ADDRESS 0x00000001	Indicates that the TargetNetAddressLength and TargetNetAddress fields are present.
LB_LOAD_BALANCE_INFO 0x00000002	Indicates that the LoadBalanceInfoLength and LoadBalanceInfo fields are present.
LB_USERNAME 0x00000004	Indicates that the UserNameLength and UserName fields are present.
LB_DOMAIN 0x00000008	Indicates that the DomainLength and Domain fields are present.
LB_PASSWORD 0x00000010	Indicates that the PasswordLength and Password fields are present.
LB_DONTSTOREUSERNAME 0x00000020	Indicates that when reconnecting, the client MUST send the username specified in the UserName field to the server in the Client Info PDU (section 2.2.1.11.1.1).
LB_SMARTCARD_LOGON 0x00000040	Indicates that the user can use a smart card for authentication.
LB_NOREDIRECT 0x00000080	Indicates that the contents of the PDU are for informational purposes only. No actual redirection is required.
LB_TARGET_FQDN 0x00000100	Indicates that the TargetFQDNLength and TargetFQDN fields are present.
LB_TARGET_NETBIOS_NAME 0x00000200	Indicates that the TargetNetBiosNameLength and TargetNetBiosName fields are present.
LB_TARGET_NET_ADDRESSES 0x00000800	Indicates that the TargetNetAddressesLength and TargetNetAddresses fields are present.
LB_CLIENT_TSV_URL 0x00001000	Indicates that the TsvUrlLength and TsvUrl fields are present.<38>
LB_SERVER_TSV_CAPABLE 0x00002000	Indicates that the server supports redirection based on the TsvUrl present in the LoadBalanceInfo sent by the client.<39>
LB_PASSWORD_IS_PK_ENCRYPTED 0x00004000	Indicates that the data in the Password field is encrypted and contains data that SHOULD be used in the RDSTLS Authentication Request PDU with Password Credentials (section 2.2.17.2).
LB_REDIRECTION_GUID 0x00008000	Indicates that the RedirectionGuidLength and RedirectionGuid fields are present.
LB_TARGET_CERTIFICATE 0x00010000	Indicates that the TargetCertificateLength and TargetCertificate fields are present.

TargetNetAddressLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the TargetNetAddress field.

TargetNetAddress (variable): A variable-length array of bytes containing the IP address of the server (for example, "192.168.0.1" using dotted decimal notation) in Unicode format, including a null-terminator.

LoadBalanceInfoLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the LoadBalanceInfo field.

LoadBalanceInfo (variable): A variable-length array of bytes containing load balancing information that MUST be treated as opaque data by the client and passed to the server if the LB_TARGET_NET_ADDRESS (0x00000001) flag is not present in the RedirFlags field and a reconnection takes place. See section 3.2.5.3.1 for details on populating the routingToken field of the X.224 Connection Request PDU (section 2.2.1.1).

UserNameLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the UserName field.

UserName (variable): A variable-length array of bytes containing the username of the user in Unicode format, including a null-terminator.

DomainLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the Domain field.

Domain (variable): A variable-length array of bytes containing the domain to which the user connected in Unicode format, including a null-terminator.

PasswordLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the Password field.

Password (variable): A variable-length array of bytes containing a password to be used when connecting to the redirected server. If the LB_PASSWORD_IS_PK_ENCRYPTED (0x00004000) flag is specified in the RedirFlags field, then the password MUST be treated as an opaque encrypted blob and sent to the target server using the RDSTLS protocol (section 5.4.5.3). If the LB_PASSWORD_IS_PK_ENCRYPTED flag is not set, then the Password field contains a cleartext password (in Unicode format), including a null-terminator, that MUST be passed to the target server on successful connection.

TargetFQDNLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the TargetFQDN field.

TargetFQDN (variable): A variable-length array of bytes containing the fully qualified domain name (FQDN) of the target machine, including a null-terminator.

TargetNetBiosNameLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the TargetNetBiosName field.

TargetNetBiosName (variable): A variable-length array of bytes containing the NETBIOS name of the target machine, including a null-terminator.

TsvUrlLength (4 bytes): The length, in bytes, of the TsvUrl field.<40>

TsvUrl (variable): A variable-length array of bytes.<41> If the client has previously sent a TsvUrl field in the LoadBalanceInfo to the server in the expected format, then the server will return the same TsvUrl to the client in this field. The client verifies that it is the same as the one that it previously passed to the server and if they don't match, the client immediately disconnects the connection.

RedirectionGuidLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the RedirectionGuid field.

RedirectionGuid (variable): A variable-length array of bytes containing a Base64-encoded ([RFC4648] section 4) GUID ([MS-DTYP] section 2.3.4) in Unicode format that functions as a unique identifier for the redirected connection.

TargetCertificateLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the TargetCertificate field.

TargetCertificate (variable): A variable-length array of bytes containing a Base64-encoded Target Certificate Container (section 2.2.13.1.2) structure in Unicode format that encapsulates the X.509 certificate of the target server.

TargetNetAddressesLength (4 bytes): A 32-bit unsigned integer. The length, in bytes, of the TargetNetAddresses field.

TargetNetAddresses (variable): A variable-length array of bytes containing the target IP addresses of the server to connect against, stored in a Target Net Addresses (section 2.2.13.1.1) structure.

Pad (8 bytes): An optional 8-element array of 8-bit unsigned integers. Padding. Values in this field MUST be ignored.