4.1.1 Client X.224 Connection Request PDU

  • Article

The following is an annotated dump of the X.224 Connection Request PDU (section 2.2.1.1).

 00000000 03 00 00 2c 27 e0 00 00 00 00 00 43 6f 6f 6b 69     ...,'......Cooki
 00000010 65 3a 20 6d 73 74 73 68 61 73 68 3d 65 6c 74 6f     e: mstshash=elto
 00000020 6e 73 0d 0a 01 00 08 00 00 00 00 00                 ns..........
  
 03 -> TPKT Header: version = 3
 00 -> TPKT Header: Reserved = 0
 00 -> TPKT Header: Packet length - high part
 2c -> TPKT Header: Packet length - low part (total = 44 bytes)
 27 -> X.224: Length indicator (39 bytes)
 e0 -> X.224: Type (high nibble) = 0xe = CR TPDU; credit (low nibble) = 0
 00 00 -> X.224: Destination reference = 0
 00 00 -> X.224: Source reference = 0
 00 -> X.224: Class and options = 0
  
 43 6f 6f 6b 69 65 3a 20 6d 73 74 73 68 61 73 68 
 3d 65 6c 74 6f 6e 73 -> "Cookie: mstshash=eltons"
 0d0a -> Cookie terminator sequence
  
 01 -> RDP_NEG_REQ::type (TYPE_RDP_NEG_REQ)
 00 -> RDP_NEG_REQ::flags (0)
 08 00 -> RDP_NEG_REQ::length (8 bytes)
 00 00 00 00 -> RDP_NEG_REQ::requestedProtocols (PROTOCOL_RDP)