rdp

var Decoder = &decoder.StreamDecoder{
	Type:        types.Type_NC_RDP,
	Name:        serviceRDP,
	Description: "Remote Desktop Protocol (RDP) is Microsoft's remote access protocol",
	PostInit: func(d *decoder.StreamDecoder) error {
		var err error
		rdpLog, _, err = logging.InitZapLogger(
			decoderconfig.Instance.Out,
			"rdp",
			decoderconfig.Instance.Debug,
		)
		return err
	},
	CanDecode: func(client, server []byte) bool {

		if len(client) >= 11 && client[0] == tpktVersion {

			if client[5] == x224ConnectionRequest {
				return true
			}

			if bytes.Contains(client, []byte("Cookie:")) && bytes.Contains(client, []byte("mstshash=")) {
				return true
			}
		}
		return false
	},
	DeInit: func(sd *decoder.StreamDecoder) error {
		return rdpLog.Sync()
	},
	Factory: &rdpReader{},
	Typ:     core.TCP,
}