How RDP Works: Remote Desktop, NLA, Brute Force & BlueKeep (Animated)

RDP lets you see and control a Windows desktop over the network. It is extremely useful for administrators, and for the same reason an RDP port open to the internet is one of the most common ways ransomware gangs get in.

1. Connection request: which security will we use?

The client connects to TCP 3389 and says which security it supports.

1. X.224 REQUEST (Admin laptop → Windows server): The client asks for the strongest option: TLS with NLA.
2. X.224 CONFIRM (Windows server → Admin laptop): The server agrees.

Wireshark filter:

rdp

2. Tls + nla: encrypt, then authenticate first

A TLS tunnel is set up, then the user’s credentials are checked through it before any desktop is created.

1. TLS HANDSHAKE (Admin laptop → Windows server): From here on, the traffic is encrypted.
2. CredSSP (Admin laptop → Windows server): Credentials are verified first.
3. AUTH OK (Windows server → Admin laptop): Only now does Windows build a desktop session.

Wireshark filter:

tls && tcp.port == 3389

3. The remote desktop: screen out, keyboard and mouse in

The server streams screen updates; the client sends key presses and mouse moves.

1. GRAPHICS (Windows server → Admin laptop): The desktop appears on the admin’s laptop.
2. INPUT (Admin laptop → Windows server): Input travels the other way.

Wireshark filter:

tcp.port == 3389

4. Brute force: attack: rdp exposed to the internet

Search engines like Shodan list millions of open RDP ports. Bots try password lists nonstop; one weak admin password hands over the whole server.

1. CredSSP (Attacker → Windows server): Thousands of attempts, visible as Event ID 4625 in the Security log.
2. AUTH OK (Windows server → Attacker): The attacker gets a full desktop as administrator. This is how many ransomware incidents begin.

Wireshark filter:

tcp.dstport == 3389 && tcp.flags.syn == 1

5. Hide it, lock it: defence: never expose 3389

Close RDP at the firewall and reach it only through a VPN or RD Gateway with MFA. Keep NLA on, set account lockout, and patch.

1. SYN (Attacker → Windows server): From the internet the port simply doesn’t exist.

Windows / firewall:

Block inbound TCP 3389 from the internet
Account lockout threshold: 5 attempts
Require Network Level Authentication: Enabled

FAQ