yuhong is correct: RDP rides inside a TLS connection (if I recall, pre-Vista didn&#x27;t use TLS but there was some other encryption scheme).  I&#x27;m not sure how much work it would be to sniff&#x2F;log session keys and display the decrypted traffic in a nice format.  I&#x27;ve never seen a tool for it.  I&#x27;d be surprised if Microsoft doesn&#x27;t have at least some netmon.exe tooling for it but it may not be released.